skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

configuring-windows-event-logging-for-detection

Configures Windows Advanced Audit Policy and event forwarding to generate security events for SIEM detection.

954|172|Updated Mar 13, 2026
Search Tags:#windows#event logging#siem#detection engineering#security monitoring#audit policy#wef
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill configuring-windows-event-logging-for-detection
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: configuring-windows-event-logging-for-detection
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/endpoint-security/configuring-windows-event-logging-for-detection
Command: npx skills add https://github.com/xalgord/xalgorix --skill configuring-windows-event-logging-for-detection

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Windows endpoints ship with minimal default auditing, so security teams lack the event telemetry needed to detect logons, process execution, privilege use, and lateral movement. This Skill guides the correct configuration of Advanced Audit Policy, command-line logging, log sizing, and Windows Event Forwarding so high-fidelity events actually reach a SIEM.

Core Features & Use Cases

  • Advanced Audit Policy Setup: Recommended GPO subcategory settings for logon, account management, object access, privilege use, and process creation auditing.
  • Command-Line and Log Configuration: Enables Event 4688 command-line capture via registry/GPO and increases Security and PowerShell log sizes beyond the 20 MB default.
  • Windows Event Forwarding: Steps to configure WEF subscriptions and WinRM so events like 4624, 4688, 4720, 7045, and 1102 are forwarded to a central collector.
  • Use Case: A detection engineer needs process creation events with full command lines flowing into a SIEM from all domain endpoints; this Skill walks through the GPO, registry, log sizing, and WEF subscription steps, including verification with Atomic Red Team T1059.001.

Quick Start

Configure Windows Advanced Audit Policy and event forwarding on my domain endpoints so process creation events with command lines are forwarded to my SIEM.

Frequently Asked Questions about configuring-windows-event-logging-for-detection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enable command line logging in Windows Event 4688?▼

Enable the Audit Process Creation subcategory, then set the registry value ProcessCreationIncludeCmdLine_Enabled to 1 under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit, or enable the matching GPO setting. Without this, 4688 events log with a blank CommandLine field.

How do I configure Windows Event Forwarding to a SIEM?▼

Run wecutil qc on the collector, create a subscription for key event IDs such as 4624, 4688, and 1102, then configure WinRM and the Subscription Manager target on source endpoints via GPO. Verify with wecutil gr that sources show as Active.

Why does auditpol show No Auditing when my GPO says Success and Failure?▼

GPO merge and precedence issues can leave subcategories unset on the endpoint even when the GPO looks correct. Always validate with auditpol /get on the target host rather than trusting the GPMC view.

Should I use basic or advanced audit policy in Windows?▼

Use Advanced Audit Policy exclusively, since basic and advanced policies conflict. Also enable SCENoApplyLegacyAuditPolicy so legacy category settings do not override your subcategory configuration.

What size should the Windows Security event log be?▼

The default 20 MB Security log fills in minutes on busy servers, so raise it to at least 1 GB using wevtutil sl Security /ms:1073741824 or the equivalent GPO setting. Forward events centrally so local logs are not lost if an endpoint is wiped.

When should I not use this Windows event logging skill?▼

Do not use it for Sysmon configuration, which is covered separately, or for Linux audit logging. It targets Windows Server and Windows 10/11 systems in Active Directory environments.

Related Skills

Explore More Software Engineering Skills→
404kidwiz404kidwiz

windows-infra-admin

Automate Windows Server and Active Directory administration with PowerShell.

Community
Advanced
YukiIto1999YukiIto1999

detecting-kerberoasting-attacks

Detect Kerberoasting indicators from Windows Event 4769 and 4624 logs.

Community
Advanced
OpenTideHQOpenTideHQ
4

windows-event-logs

Document Windows-native telemetry sources and audit policy prerequisites for detection engineering.

Official
Advanced
balsm-healthbalsm-health
2

hunting-for-persistence-mechanisms-in-windows

Identify adversary persistence mechanisms in Windows endpoints via registry keys, services, scheduled tasks, and WMI subscriptions.

Official
Advanced