palantir / windows-event-forwarding

A repository for using windows event forwarding for incident detection and response
Other
1.22k stars 267 forks source link

Event Providers and Channels - DB Audit Events #50

Open Greyland99 opened 4 years ago

Greyland99 commented 4 years ago

The MD for the Event Channels says: The Event Channel manifest provided in this project consists of 16 individual providers, each with 7 channels. Channels follow a standard naming scheme of WEC[#], where the number is related to the provider.

But if i look into it, there are only Channels for WEC to WEC7 + WEC16. WEC8 to WEC15 doesn't have Channels. I think I can use it to generate my own Channels, but it would be helpfull to have some more information about it in the MD File.

  1. A hint that not all providers have channels, but the providers are there to add more channels, would make sense in my opinion.
  2. Additional / more detailed information about how to customize and what to pay attention to would also be helpful. (I am exactly working on this. Maybe I can provide a suggestion for the customization.)