AutorunsToWinEventLog.ps1
A collection of Windows Event Forwarding configurations and subscriptions for centralized security event collection and incident detection.
What is AutorunsToWinEventLog.ps1?
Windows Event Forwarding Guidance is an open-source repository providing configurations and subscriptions to deploy Windows Event Forwarding (WEF) for security event collection. It helps organizations centralize Windows event logs from hosts to collector servers without installing additional agents, enabling detection of security incidents and anomalous activities. The project includes pre-built subscriptions, Group Policy recommendations, and custom event channels to streamline deployment.
Security engineers, incident responders, and system administrators in Windows-based enterprises who need to implement centralized logging for threat detection and forensic analysis.
It offers production-ready, community-vetted WEF configurations that reduce deployment time and complexity compared to building subscriptions from scratch. The agentless approach leverages native Windows capabilities, making it a cost-effective and scalable solution for security monitoring.
Overview
A repository for using windows event forwarding for incident detection and response
Use Cases
Best For
- Centralizing Windows security event logs for SIEM ingestion
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
