issues
search
palantir
/
windows-event-forwarding
A repository for using windows event forwarding for incident detection and response
Other
1.21k
stars
269
forks
source link
issues
Newest
Newest
Most commented
Recently updated
Oldest
Least commented
Least recently updated
Update Event-Log-Diagnostics.xml
#61
amadeuskonopko
opened
1 month ago
0
change security access right and max evt/sec to forward
#60
lprat
opened
1 year ago
1
Update README.md
#58
awesomecogs
opened
3 years ago
0
Spelling
#57
jsoref
opened
3 years ago
1
Update default log file size
#56
ruffy91
opened
3 years ago
1
Changed Autorunsc64.exe download to use HTTP URI
#55
null-default
opened
3 years ago
2
Download of Autorunsc64.exe Incorrectly Uses HTTPS
#54
null-default
opened
3 years ago
3
Fix query for logging event id 5138 as intended instead of 5178
#53
dboekhout
closed
2 years ago
1
Software-Restriction-Policies.xml incorrect syntax
#52
appelboom
opened
3 years ago
2
Update Shares.xml
#51
lengyeltom
closed
3 years ago
1
Event Providers and Channels - DB Audit Events
#50
Greyland99
opened
3 years ago
0
Audit CVE subscription
#49
mdecrevoisier
closed
2 years ago
0
Protected groups subscriptions
#48
mdecrevoisier
closed
2 years ago
0
Radius-NPS subscription
#47
mdecrevoisier
closed
2 years ago
0
DHCP server subscription
#46
mdecrevoisier
closed
2 years ago
0
Crytpo API subscription
#45
mdecrevoisier
closed
2 years ago
0
ADFS subscription
#44
mdecrevoisier
closed
2 years ago
0
Add OCSP settings
#43
mdecrevoisier
closed
2 years ago
0
Added query 4 and 5
#42
mdecrevoisier
closed
2 years ago
0
Add ID 6041 - CVE-2018-0886
#41
mdecrevoisier
closed
2 years ago
0
Update Windows-Defender.xml
#40
mdecrevoisier
closed
2 years ago
0
Push for performance improvement
#39
mdecrevoisier
opened
5 years ago
1
Collector Server
#38
coleJ98
opened
5 years ago
3
WEC won't forward events to self if WinRM GPO doesn't include IPv6 filter
#37
ghost
opened
5 years ago
3
EventID 4648 not included
#36
patrickg2525
closed
5 years ago
0
wecsvc stops working after a while
#35
bluedefxx
opened
5 years ago
26
Uploading subscription buffer increases
#34
novaksam
opened
5 years ago
1
Fixing exploit guard ep subscriptions.
#33
cryps1s
closed
5 years ago
0
Updating SubscriptionIds to be unique per subscription
#32
clong
closed
5 years ago
0
Fr/exploit guard asr
#31
cryps1s
closed
5 years ago
0
Add local group enumeration logic
#30
andyrobbins
closed
5 years ago
1
Are all servers/ workstations supposed to subscribe to all subscriptions?
#29
patrickg2525
closed
5 years ago
3
Authentication suppression rule may be a little aggressive for some
#28
uplateandonline
opened
5 years ago
1
Removing guidance to enable auditing of privilege use
#27
clong
closed
6 years ago
0
wecutil ss error x057
#26
adrwh
opened
6 years ago
4
Server 2016 collector woe
#25
mineral4x
opened
6 years ago
1
character encoding problems with some files
#24
patrickg2525
closed
6 years ago
2
Added enumeration of other persistence mechanisms to AutorunsToWinEventLog.ps1
#23
vector-sec
closed
5 years ago
3
DUMMY_EVENT & DUMMY_TEMPLATE in custom channels
#22
postbluecz
closed
6 years ago
2
Recommended WEC Server Hardware Specifications
#21
josephbleroy
closed
6 years ago
4
Fr/wef subscription table
#20
cryps1s
closed
6 years ago
0
Update Software-Restriction-Policies.xml
#19
craigsmooth
closed
6 years ago
1
Update Software-Restriction-Policies.xml
#18
craigsmooth
closed
6 years ago
1
Major overhaul.
#17
cryps1s
closed
6 years ago
0
Addressing text wrap issue in AutorunsToWinEventLog
#16
clong
closed
6 years ago
0
Wrapping of Image_Path and Hashes
#15
spaz1729
closed
6 years ago
5
Removed test channel
#14
ghost
closed
6 years ago
2
Adding ADFS, Duo, DG, EG, Office, WMI
#13
clong
closed
6 years ago
0
Adding CustomEventChannels.dll (includes sysmon & SRP)
#12
clong
closed
6 years ago
0
Don't hide Microsoft signed entries in AutorunsToWinEventLog
#11
clong
closed
6 years ago
1
Next