Windows Event Forwarding (WEF) is a powerful log forwarding solution integrated within modern versions of Microsoft Windows.
Instead of relying on third-party forwarders (e.g. Splunk, Beats), we can leverage native Windows components. Windows event forwarding subscriptions are XML documents that allow you to include or exclude events based on highly granular information. In DetectionLab, advanced Windows auditing is enabled and the WEF host is used as a Windows event collector. Windows endpoints pull event “subscriptions” from WEF, defining which events we want to collect. Once the events have been centralized on WEF, they are then sent to Splunk via a single Splunk forwarder.
Locally on WEF: