Windows Event Collector

Windows Event Collector (WEC) is a Windows service that collects events from Windows Event Logs on remote computers and forwards them to a central collector. WEC supports various Windows event sources including Security, System, Application, and custom event logs.

The Windows Event Forwarding (WEF) architecture allows organizations to collect events from multiple Windows servers and workstations without deploying agent software on each source machine. Configuration can be centrally managed through Group Policy.

Data Flow

The following diagram shows how Windows events flow through Log Collector's ingestion pipeline:

flowchart LR A[Windows Endpoints] --> B[Windows Event Forwarding] B --> C[LogScale Collector] C --> D[Parser Pipeline] subgraph "Parser Types" D --> D1[Windows Event XML Parser] D --> D2[Security Event Parser] D --> D3[System Event Parser] D --> D4[Application Event Parser] end D1 & D2 & D3 & D4 --> E[Compression] E --> F[Repository Storage]
flowchart LR A[Windows Endpoints] --> B[Windows Event Forwarding] B --> C[LogScale Collector] C --> D[Parser Pipeline] subgraph "Parser Types" D --> D1[Windows Event XML Parser] D --> D2[Security Event Parser] D --> D3[System Event Parser] D --> D4[Application Event Parser] end D1 & D2 & D3 & D4 --> E[Compression] E --> F[Repository Storage]

Once events are collected by WEC, they can be forwarded to Falcon LogScale Collector using the LogScale Collector or other log shippers that support reading Windows Event Logs.