Threat Hunting Windows Event Logs Introduction Event logs are a fantastic way to spot potential attacks on a Windows Machine and be able to explain what and how it occurred. However, not all event logs are useful, even if there are lot of them. It can be intimidating and requires good eyes to read through these logs. This blog will explain why some event logs are more useful than others and how to use them. Event log structure in windows The Windows event log captures hardware and software events that take place on a Windows operating system. It helps network administrators in keeping an eye out for threats and issues that could harm performance. Windows maintains event logs in a standardized format that makes it possible to understand the data. The following are an event log's primary components: · Log name: Name of the event log to which events from different logging components will be written. Events are commonly logged for system, security, and applications.
