Top Windows events you should monitor

Your infrastructure continuously generates log data that you can use to monitor network infrastructure and manage security events.

I share you my cheat sheet of importants events that I used to monitor, but before, lets activate all the logs we need

1 / Enable Advanced auditing

For some events we’ld like to monitor, we’ve to activate some additional auditing features provided by microsoft :

1.1 / Shared objects

In the Group Policy Management Console you can activate the “Audit File Share” by navigating to Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policies -> Object Access -> Audit File Share

1.2 / Access object auditing

Object access auditing is not enabled by default but should be enabled on sensitive systems. To do so, simply set use the Local Security Policy to set Security Settings -> Local Policies -> Audit Policy -> Audit object access to Enabled for Success and Failure

2 / Events you should monitor

2.1 / Account Management Events

These events are recorded on the system where the account was created or modified, a Hacker will usually try to create rogue accounts and try to gain privileges.

You can find theese events in the Security Section of Event Viewer

2.2 / Scheduled Task Logging

2.3 / File Access Logging

To activate the file access logging, you’ve to activate the logging on a folder (and all subfolders or not) or file. To do that : Right click on a file/folder, Security Pannel, Advanced, Auditing pannel, Continue, & “Add”

2.4 / Network share Logging

2.5 / Firewall rules changes

Thanks to read this post :)