Centralizing Windows Event Log: Configuring WEF and Winlogbeat

In an infrastructure with 50+ Windows servers, manual log analysis is a waste of time. Without centralization, the mean time to detect (MTTD) an incident on Windows hosts is 2–3 times higher than on Linux. By configuring WEF for 200+ servers in a domain, we reduced MTTD from 48 hours to 15 minutes—an 8x improvement. This cuts incident response time and boosts Windows Server audit efficiency. Event Log Forwarding (WEF) is a built-in Windows mechanism based on Microsoft documentation on WinRM, allowing event collection without a third-party agent.

Windows Event Forwarding (WEF): Native approach

WEF is a mechanism based on WinRM. Architecture: Windows Event Collector (WEC)—an aggregator server that subscribes to sources (Collector Initiated) or waits for push from sources (Source Initiated). For a domain environment, Source Initiated via GPO is the preferred option: no permissions required on each source individually, scales to thousands of nodes. A typical collector can process up to 5000 events per second.

A common mistake is forgetting to configure HTTPS for WinRM, leaving traffic unencrypted. Or not filtering EventIDs, clogging the channel with millions of unnecessary events.

How to configure WEF via GPO?

Configuration involves three steps:

1. Configure WinRM on the collector and sources via GPO.
2. Create a subscription on the collector specifying the target EventIDs.
3. Assign permissions and verify connectivity.

Configure WinRM on the collector and sources

# On the collector
winrm quickconfig -q
wecutil qc -q

# On each source (via GPO or locally)
winrm quickconfig -q
Set-Item WSMan:\localhost\Client\TrustedHosts -Value "collector.domain.com"

Create a subscription on the collector

XML subscription template for collecting security, system, and application events:

<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
  <SubscriptionId>SecurityEvents</SubscriptionId>
  <SubscriptionType>SourceInitiated</SubscriptionType>
  <Description>Security events from all domain servers</Description>
  <Enabled>true</Enabled>
  <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
  <ConfigurationMode>MinLatency</ConfigurationMode>
  <Delivery Mode="Push">
    <Batching>
      <MaxItems>100</MaxItems>
      <MaxLatencyTime>1000</MaxLatencyTime>
    </Batching>
    <PushSettings>
      <Heartbeat Interval="900000"/>
    </PushSettings>
  </Delivery>
  <Query>
    <![CDATA[
      <QueryList>
        <Query Id="0">
          <Select Path="Security">
            *[System[(EventID=4624 or EventID=4625 or EventID=4634 or EventID=4648 or EventID=4720 or EventID=4722 or EventID=4724 or EventID=4728 or EventID=4732 or EventID=4756 or EventID=4767 or EventID=4771 or EventID=4776)]]
          </Select>
          <Select Path="System">
            *[System[Level<=3]]
          </Select>
          <Select Path="Application">
            *[System[Level=1 or Level=2]]
          </Select>
        </Query>
      </QueryList>
    ]]>
  </Query>
  <ReadExistingEvents>false</ReadExistingEvents>
  <TransportName>HTTP</TransportName>
  <ContentFormat>RenderedText</ContentFormat>
  <Locale Language="en-US"/>
  <LogFile>ForwardedEvents</LogFile>
  <AllowedSourceDomainComputers>O:NSG:NSD:(A;;GA;;;DC)(A;;GA;;;NS)</AllowedSourceDomainComputers>
</Subscription>

Save the file as security-events.xml and run on the collector: wecutil cs security-events.xml. Key EventIDs: 4624 (successful logon), 4625 (failed logon), 4720 (user creation), 4724 (password reset), 4728/4732/4756 (addition to privileged groups).

Winlogbeat: Shipping to Elasticsearch

Winlogbeat is the Filebeat analog for Windows Event Log, part of the Elastic Stack. Its advantage is built-in filtering and transformation, the downside is dependence on Elasticsearch.

Why combine WEF and Winlogbeat?

WEF aggregates logs to the collector, and Winlogbeat ships them to Elasticsearch. This approach reduces the load on each source by 2x compared to installing Winlogbeat on every server. Additionally, filtering at the collector reduces the volume of transmitted data by 60–80%. Below is the Winlogbeat configuration for ForwardedEvents:

# winlogbeat.yml
winlogbeat.event_logs:
  - name: Application
    ignore_older: 72h
    level: critical, error, warning
  - name: System
    ignore_older: 72h
    level: critical, error, warning
  - name: Security
    ignore_older: 72h
    event_id: 4624, 4625, 4634, 4648, 4720, 4722, 4724, 4728, 4732, 4756, 4767, 4771, 4776, 7045
  - name: ForwardedEvents
    ignore_older: 72h
  - name: Microsoft-Windows-PowerShell/Operational
    ignore_older: 72h
processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
output.elasticsearch:
  hosts: ["elasticsearch.monitoring.svc:9200"]
  index: "winlogbeat-%{[agent.version]}-%{+yyyy.MM.dd}"
  ssl.certificate_authorities: ["C:/certs/ca.crt"]
  ssl.certificate: "C:/certs/winlogbeat.crt"
  ssl.key: "C:/certs/winlogbeat.key"
setup.template.settings:
  index.number_of_shards: 1
  index.number_of_replicas: 0

Installation via PowerShell:

$url = "https://artifacts.elastic.co/downloads/beats/winlogbeat/winlogbeat-latest-windows-x86_64.zip"
Invoke-WebRequest -Uri $url -OutFile "winlogbeat.zip"
Expand-Archive -Path "winlogbeat.zip" -DestinationPath "C:\Program Files\winlogbeat"
cd "C:\Program Files\winlogbeat\winlogbeat-latest-windows-x86_64"
.\install-service-winlogbeat.ps1
Start-Service winlogbeat

NXLog: Universal agent

NXLog Community Edition works both with WEF and with shipping to Syslog, Loki, or any other endpoint. Useful when Elasticsearch is not in the stack.

Example NXLog configuration for shipping to Loki:

<Input eventlog>
  Module im_msvistalog
  Query <QueryList><Query Id="0"><Select Path="Security">*[System[(Level<=3) or (EventID=4624 or EventID=4625)]]</Select></Query></QueryList>
  SavePos TRUE
  ReadFromLast TRUE
</Input>
<Output loki>
  Module om_http
  URL http://loki.monitoring:3100/loki/api/v1/push
  ContentType application/json
  <Exec>
    $Message = to_json();
  </Exec>
</Output>
<Route r1>
  Path eventlog => loki
</Route>

What’s included in the work—deliverables

• Architecture design for log collection (approach selection, WinRM and GPO configuration)
• Creation of WEF subscriptions for your EventIDs (security, applications, system)
• Installation and configuration of Winlogbeat/NXLog on the collector
• Integration with SIEM (Elastic, Loki, Splunk)—setting up indices and alerting
• Documentation: flow diagram, runbook for expansion, list of filtered events
• Team training (2-hour workshop)
• Warranty on configuration—30 days of free support

Setting up Event Log Forwarding takes 1–3 days depending on domain size and filtering requirements. Contact us to assess your infrastructure within 1 day. Our engineers hold Microsoft certifications and have 5+ years of experience in building monitoring systems for Windows environments. Order the setup—get a consultation.