You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: EventSubscriptionsCollections/README.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,10 +14,10 @@ Make any changes to the `EventCollectorSubscriptions.csv` configuration file. En
14
14
15
15
Bear in mind, that in some columns of `EventCollectorSubscriptions.csv` files, mainly `AllowedSourceDomainComputers`, `AllowedIssuerCAList` and `AllowedSubjectList`, you can specify several values separated by semicolon `;` symbol, e.g:
Copy file name to clipboardExpand all lines: GroupPolicyObjects/Windows Event Collector.md
+8-8Lines changed: 8 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,7 +16,7 @@
16
16
17
17
## Configuration
18
18
19
-
Set the following setting **Computer Configuration -> Administrative Templates -> Windows Components -> Windows Remote Management (WinRM)/WinRM Service -> Allow Remote Server Management through WinRM** to:
19
+
Set the following setting `Computer Configuration -> Administrative Templates -> Windows Components -> Windows Remote Management (WinRM)/WinRM Service -> Allow Remote Server Management through WinRM` to:
20
20
21
21
-**IPV4 filter**: [network ranges]
22
22
-**IPv6 filter**: *
@@ -28,13 +28,13 @@ Set the following setting **Computer Configuration -> Administrative Templates -
28
28
29
29
30
30
31
-
Set the following setting **Computer Configuration -> Policies -> Windows Settings -> Security Settings -> System Services -> Windows Remote Management (WS-Management)** to:
31
+
Set the following setting `Computer Configuration -> Policies -> Windows Settings -> Security Settings -> System Services -> Windows Remote Management (WS-Management)` to:
32
32
33
33
-**Startup Mode**: Automatic
34
34
35
35
36
36
37
-
Create new service configuration under **Computer Configuration -> Preferences -> Control Panel Settings -> Services** with the following settings:
37
+
Create new service configuration under `Computer Configuration -> Preferences -> Control Panel Settings -> Services` with the following settings:
38
38
39
39
-**Service name**: WinRM
40
40
-**Action**: Start service
@@ -45,23 +45,23 @@ Create new service configuration under **Computer Configuration -> Preferences -
45
45
46
46
## Optional
47
47
48
-
Set the following setting **Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Polices/User Rights Assignment** to:
48
+
Set the following setting `Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Polices/User Rights Assignment` to:
49
49
50
50
-**Log on as a service**: [objects]
51
51
52
52
**Note**: **objects** is a list of all domain groups and/or accounts allowed to log on the target server as a service.
53
53
54
54
55
55
56
-
Set the following setting **Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Restricted Groups** to:
56
+
Set the following setting `Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Restricted Groups` to:
57
57
58
58
-**BUILTIN\Administrators**: [objects]
59
59
60
60
**Note**: **objects** is a list of all domain groups and/or accounts given the administrator rights on the target server.
61
61
62
62
63
63
64
-
Create new registry key under **Computer Configuration -> Preferences -> Windows Settings -> Registry** with the following settings:
64
+
Create new registry key under `Computer Configuration -> Preferences -> Windows Settings -> Registry` with the following settings:
65
65
66
66
-**Action**: Update
67
67
-**Hive**: HKEY_LOCAL_MACHINE
@@ -72,7 +72,7 @@ Create new registry key under **Computer Configuration -> Preferences -> Windows
72
72
73
73
74
74
75
-
Create new task under **Computer Configuration -> Preferences -> Control Panel Settings -> Scheduled Tasks** with the following settings:
75
+
Create new task under `Computer Configuration -> Preferences -> Control Panel Settings -> Scheduled Tasks` with the following settings:
76
76
77
77
-**Task type**: Immediate Task (At least Windows 7)
78
78
-**Task**:
@@ -86,7 +86,7 @@ Create new task under **Computer Configuration -> Preferences -> Control Panel S
86
86
87
87
88
88
89
-
Create new task under **Computer Configuration -> Preferences -> Control Panel Settings -> Scheduled Tasks** with the following settings:
89
+
Create new task under `Computer Configuration -> Preferences -> Control Panel Settings -> Scheduled Tasks` with the following settings:
90
90
91
91
-**Task type**: Scheduled Task (At least Windows 7)
Copy file name to clipboardExpand all lines: GroupPolicyObjects/Windows Event Forwarding.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,29 +13,29 @@
13
13
14
14
## Configuration
15
15
16
-
Set the following setting **Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Restricted Groups** to:
16
+
Set the following setting `Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Restricted Groups` to:
17
17
18
18
-**BUILTIN\Event Log Readers**: NT AUTHORITY\NETWORK SERVICE
19
19
20
20
**Note**: Add to **BUILTIN\Event Log Readers** other groups/users, that should have remote access to local logs.
21
21
22
22
23
23
24
-
Set the following setting **Computer Configuration -> Administrative Templates -> Windows Components -> Event Log Service -> Security -> Configure log access** to:
24
+
Set the following setting `Computer Configuration -> Administrative Templates -> Windows Components -> Event Log Service -> Security -> Configure log access` to:
Set the following setting **Computer Configuration -> Administrative Templates -> Windows Components -> Event Forwarding -> Configure forwarder resource usage** to:
30
+
Set the following setting `Computer Configuration -> Administrative Templates -> Windows Components -> Event Forwarding -> Configure forwarder resource usage` to:
31
31
32
32
-**The maximum forwarding rate ( events/sec ) allowed for the forwarder**: [X]
33
33
34
34
**Note**: **X** is a number of events/per second sent to the Event Collector per each event source. Value too low would make the collector to fall behind it's event sources, value too high would make the collector's event log to overflood and erase previos events, before you can analyze them or collect them to your SIEM. You should test this setting in your environment and choose the value, that works for you.
35
35
36
36
37
37
38
-
Set the following setting **Computer Configuration -> Administrative Templates -> Windows Components -> Event Forwarding -> Configure target Subscription Manager** to:
38
+
Set the following setting `Computer Configuration -> Administrative Templates -> Windows Components -> Event Forwarding -> Configure target Subscription Manager` to:
0 commit comments