Skip to content
WindowsHardening

Area 10 / 12

Audit & Logging

Default Windows logging answers almost none of the questions an incident responder asks. This area configures advanced audit policy subcategories, process command-line capture, log sizes that cover weeks rather than hours, Sysmon for process, network and DNS telemetry, and Windows Event Forwarding so evidence leaves the host before an attacker can clear it.

Start the path

Learning path

0/4 done
  1. 01Windows audit policy and Sysmon: a logging baselineConfigure advanced audit policy subcategories, command-line capture, log sizes, Sysmon and Windows Event Forwarding so Windows logs can answer who, what, where and when.
  2. 02Deploying and tuning Sysmon at scaleChoose a Sysmon configuration, cut noise without creating blind spots, roll out updates safely across thousands of hosts and monitor Sysmon itself.
  3. 03Windows Event Forwarding at scaleWindows Event Forwarding that holds up: collectors, source-initiated subscriptions, XPath queries, delivery tuning, Security log access and health checks.
  4. 04Windows security event IDs that matterA practical reference to the Windows event IDs worth collecting and alerting on: logons, failure codes, Kerberos, account changes, persistence and tampering.