WEF (Windows Event Forwarding) looks good and integrated to Windows for logs forwarding to feed a SIEM. I have eared also that it is better for consumming the logs as they remain in Windows standards, contrarily to solutions using nxlog. Here are two excellent articles about this technology :

  1. Monitoring what matters – Windows Event Forwarding for everyone (2015)
  2. Use Windows Event Forwarding to help with intrusion detection (2018)

My concern is it looks recent (it seems it has started since Windows 10), and system admins does not look to using it and even don't know it, at least where I am working (10k people software engineering & IT company).

So, is it really the way to go ? What are the best ways to deal with logs under Windows for automated treatment as in a SIEM ? I don't ask for SIEM technologies here, only for logs forwarding. I would like answers with use cases & constraints versus best solutions, as far as possible.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.