Windows Event Log
- 30 Jul 2025
- 1 Minute to read
- Print
- DarkLight
Windows Event Log
- Updated on 30 Jul 2025
- 1 Minute to read
- Print
- DarkLight
Article summary
Did you find this summary helpful?
Thank you for your feedback!
Overview
This Adapter allows you to connect to the local Windows Event Logs API on Windows. This means this Adapter is only available from Windows builds and only works locally (will not connect to remote Windows instances).
Configurations
Adapter Type: wel
client_options
: common configuration for adapter as defined here.evt_sources
: a comma separated list of elements in the formatSOURCE:FILTER
, whereSOURCE
is an Event Source name likeApplication
,System
orSecurity
andFILTER
is anXPath
filter value as described in the documentation linked below.
Infrastructure as Code Deployment
# Windows Event Log (WEL) Specific Docs: https://docs.limacharlie.io/docs/adapter-types-windows-event-log
# Basic Event Sources:
# evt_sources: "Security,System,Application"
# With XPath Filters:
# evt_sources: "Security:'*[System[(Level=1 or Level=2 or Level=3)]]',System:'*[System[Provider[@Name=\"Microsoft-Windows-Kernel-General\"]]]'"
# File-Based Sources:
# evt_sources: "C:\\Windows\\System32\\winevt\\Logs\\Security.evtx:'*[System[(EventID=4624)]]'"
wel:
evt_sources: "Security:'*[System[(Level=1 or Level=2 or Level=3)]]',System,Application"
client_options:
identity:
oid: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
installation_key: "YOUR_LC_INSTALLATION_KEY_WEL"
hostname: "prod-dc01.example.local"
platform: "windows"
sensor_seed_key: "wel-collector"
write_timeout_sec: 30
XPath Filter Examples
Security Events (High Priority):
Security:'*[System[(Level=1 or Level=2 or Level=3)]]'
Logon Events Only:
Security:'*[System[(EventID=4624 or EventID=4625 or EventID=4634)]]'
System Errors:
System:'*[System[(Level=1 or Level=2)]]'
Specific Provider:
Application:'*[System[Provider[@Name="Microsoft-Windows-ApplicationError"]]]'
API Doc
See the official documentation.
Was this article helpful?