Project

Windows Event Logging / What2Log

Practical guidance on which Windows events actually matter for defenders, audit policy, Sysmon and PowerShell logging configuration for detection.

Categories
Detection Engineering, SOC
Period
2023 - Present
Status
Ongoing
Technologies
Windows Event Logs, Sysmon, PowerShell, Group Policy

Problem

Windows can log almost everything, and by default logs almost nothing a defender needs. Organizations either drown their SIEM in noise or miss the handful of events that would have caught an intrusion.

Approach

Documenting and applying a “what to log” methodology: mapping high-value event IDs (authentication, process creation, script execution, lateral movement) to the attacks they expose, and packaging that as audit policy baselines, Sysmon configurations and PowerShell logging guidance that can be rolled out through Group Policy.

Findings

  • A small set of event IDs (4624/4625, 4688, 4104, Sysmon 1/3/7) covers a large share of common intrusion behavior.
  • Log volume objections usually disappear once collection is scoped to security-relevant channels instead of “everything”.
  • Written up in detail across several InfoSec Stories articles.