Watch the Gaps: Detecting (and Fixing!) Overlooked Windows Event Log Misses
summary
Examines gaps in Windows Event Log coverage that cause missed or incomplete forensic/monitoring evidence, showing how those gaps arise and demonstrating concrete detection and remediation techniques for Windows logging. Uses Windows Event Log technologies and practical fixes to detect overlooked events and correct the logging configuration or collection pipeline.
AI-written summary · about
chapters (8)
- 0:00Event Log gaps
- 1:14Event Log analysis in DFIR
- 4:33Windows Event Log structure
- 16:51Default Event Log settings
- 23:21Sigma rules gaps
- 31:08Vela and Baseline Guide
- 41:50Recommended improvements
- 42:52Q&A
related talks
41mWhat the Log?! So Many Events, so Little Time...
52mDetecting Malicious Activity: Unveiling the Secrets of MS-SQL Logging
43mHow to Tame the Event Log Beast
44mGetting The Most Out Of Sysmon
46mLearning security monitoring through failure
19mShow Me the Receipts: A Forensic Hunt for Observability
23mTopics of Interest: Five philosophies to building better application logs
32mSysmon Deep Dive: Real Detection Scenarios You Can Reproduce