Windows event forwarding needs an evidence boundary

Windows Event Forwarding moves selected events from source computers to a Windows Event Collector, usually into the ForwardedEvents log. It can reduce the number of systems an analyst must query, but the collector is not automatically a trustworthy record of everything that happened. The subscription query, source authorization, delay, local log policy, and collection health all shape the evidence.

Microsoft's documentation describes collector-initiated and source-initiated subscriptions. A collector-initiated subscription names the sources. A source-initiated subscription defines the collector and lets source computers configured through policy forward events to it. The choice changes how sources are authorized and how a missing source is detected.

Define what is not collected

A subscription is a collection of query statements. Whatever the query excludes is absent from the collector unless another local process preserves it. By default, Windows Event Forwarding forwards events generated after the subscription reaches the client. Historical events are not automatically imported. If an investigation needs a window before onboarding, collect local logs explicitly or document the gap.

Forwarding does not make the source's local log immutable. A local administrator with sufficient rights can change source state. The collector adds a separate copy, but the copy inherits any loss or tampering that occurred before forwarding. Its value depends on timely transmission and independent administration of the collector.

Keep the subscription query versioned. Include the channel, event IDs, provider, level, and filters in the review. A broad query can consume bandwidth and collector storage. A narrow query can omit the event that explains an incident. Compare the query with the detection content that depends on it.

Authorize sources as machine identities

For source-initiated subscriptions, Microsoft documents an ACL on the subscription that permits or denies machine accounts or groups of machine accounts. It does not authorize user accounts. Review the allowed domains, issuers, subjects, and any direct source list. A group that contains an unrelated workstation can become an event source if policy and network access permit it.

To forward the Security log, the source needs the appropriate read access. Microsoft's source-initiated setup guide describes adding the NETWORK SERVICE account to the EventLog Readers group. That is an access grant on the source, so it should be part of the same review as the subscription ACL.

The collector should accept only the transports and identities in its design. Restrict WinRM and the relevant HTTP or HTTPS endpoints, validate TLS configuration, and monitor the collector's service health. Do not expose a collector to the internet merely because event forwarding uses a web protocol.

Measure collection health

Track source heartbeat events, last event time, subscription status, queue depth, and collector disk space. A source that stops forwarding may still be running and generating events locally. A collector that drops events may look healthy at the service level. Alert on silence for systems that should be active, not only on error codes.

Record the destination log and retention policy. Forwarded events can contain user names, process command lines, IP addresses, and security identifiers. Apply access control and retention rules that match the sensitivity of the source logs. Restrict who can clear the ForwardedEvents log and keep administrative activity on the collector in a separate audit path.

Use a known test machine to generate a benign event and follow it from source to collector. Record the time at each stage. Test an event outside the query, a source excluded by the ACL, and a collector outage. The resulting evidence should show what the pipeline does, not what the configuration was expected to do.

Preserve context with the event

Forwarded events include source attribution, but analysts should know how the collector maps a source computer to an asset owner. Keep that mapping separately and version it. A hostname can be reused after a reimage. A machine account can move between groups. The event's source identity and the asset inventory should agree at the time of collection.

Correlate forwarding status with endpoint changes. A host that was reimaged, renamed, or moved to an untrusted network may stop forwarding without an obvious security alert. A sudden burst of events from a source can be a configuration change or an attack. Check the subscription and the source's log behavior before drawing a conclusion.

WEF is a transport and storage layer for selected Windows events. It does not determine whether a source is healthy, whether an event is malicious, or whether a query covers the right behavior. Build the pipeline around explicit evidence requirements, authorized machine identities, measurable delivery, and an independent copy of the events that matter.

References

• Microsoft Learn, Windows Event Collector
• Microsoft Learn, Setting up a Source Initiated Subscription
• Microsoft Learn, Use Windows Event Forwarding to help with intrusion detection