29 windows log collection scenarios
Scenario 1: Agent-based (Per-Host Collection) :
-
Use Case: Full Visibility + Flexibility
-
Architecture:
Includes:
-
Security / System / Application
-
PowerShell Logs
-
Sysmon
When to use:
-
Small / Medium Environments
-
Requires Custom parsing
-
High-fidelity telemetry
🟦 Scenario 2: Centralized Windows Event Forwarding (WEF) :
Use Case: Native + Low footprint\ Architecture:
Windows Hosts → WEF Collector → Logstash → Elasticsearch → Kibana
Variants:
-
Source-Initiated
-
Collector-Initiated
When to use:
-
Domain environments
-
Reduce agents
-
Compliance-heavy setups
🟦 Scenario 3: Hybrid Windows Collection
Use Case: Defense-in-depth\ Architecture:
-
Critical servers → Winlogbeat → Elasticsearch → Kibana -
Workstations → WEF → Elasticsearch → Kibana
Why this matters:
-
Performance
-
Cost
-
Risk-based logging