[GPO settings on what to log]

[ehosmer]

[GPO settings on what to log]

[1n6w3coza]

I have noticed a lot of the forwarded events in Chapter 1 Files > lme_wec_config.xml appear to come from here:

https://docs.microsoft.com/en-us/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection#appendix-e--annotated-baseline-subscription-event-query

I would expect using the audit settings on the same page under "Appendix A - Minimum recommended minimum audit policy" would get you close to having the relevant event logged:

https://docs.microsoft.com/en-us/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection#appendix-a---minimum-recommended-minimum-audit-policy

[duncan-ncc]

Closed due to project archive