WEF (Windows Event Forwarding) looks good and integrated to Windows for logs forwarding to feed a SIEM. I have eared also that it is better for consumming the logs as they remain in Windows standards, contrarily to solutions using
nxlog. Here are two excellent articles about this technology :
- Monitoring what matters – Windows Event Forwarding for everyone (2015)
- Use Windows Event Forwarding to help with intrusion detection (2018)
My concern is it looks recent (it seems it has started since Windows 10), and system admins does not look to using it and even don't know it, at least where I am working (10k people software engineering & IT company).
So, is it really the way to go ? What are the best ways to deal with logs under Windows for automated treatment as in a SIEM ? I don't ask for SIEM technologies here, only for logs forwarding. I would like answers with use cases & constraints versus best solutions, as far as possible.