Auditing, Logging & Detection
Windows Event Forwarding for domain controllers
Build a Windows Event Forwarding pipeline for DCs: source-initiated subscriptions, GPO, log access, XPath queries, collector sizing and health checks.
Intermediate
Guides tagged
#logging
Auditing, Logging & Detection
AD auditing and detection: audit policy and event IDs
Configure Advanced Audit Policy, SACLs, and Windows Event Forwarding so you can actually see Kerberoasting, DCSync, and privilege escalation in AD.
Foundation