domains / families / security / configuring-windows-event-logging-for-detection

configuring-windows-event-logging-for-detection

separate

'Configures Windows Event Logging with advanced audit policies to generate

When to use

• Configuring Windows Advanced Audit Policy for security monitoring
• Enabling process creation auditing with command line logging (Event 4688)
• Setting up logon/logoff auditing for authentication monitoring
• Sizing event log storage and forwarding to SIEM platforms

When not to use

• Sysmon configuration
• Linux audit logging

Skill page

Source