Spotting the Adversary with Windows Event Log Monitoring

The Event Delivery Optimization options shown in Figure 3 permits the collection of event logs in 15
minutes (Normal), 6 hours (Minimize Bandwidth), or 30 seconds intervals (Minimize Latency). [12] A
custom interval can be set using the wecutil command line utility.
Figure 3: Event Delivery Optimization
Configuration
Figure 4: Completed Subscription
Custom Subscriptions
The general approach to creating subscriptions using the graphical user interface lacks flexibility for
custom configuration. It may be desirable to customize the frequency of event delivery and the batch
amount of a subscription. A detailed description of the subscription schema is found in the Subscription
section of the Appendix.
Customization of subscriptions depends on the administrator’s needs and requirements. Several
subscriptions have been created and provided in the Subscriptions section of the Appendix. These
subscriptions collect events that an enterprise may be interested in collecting from domain computers.
The following tables summarize the event IDs and the category they represent for each recommended
subscriptions. The Recommended Events to Collect section discusses these events in more detail.
Each subscription focuses on account activity, application and computer failures, computer and
applications modification, and security notifications.
Windows Vista and above Events
12 http://technet.microsoft.com/en-us/library/cc749167.aspx
8