"Keeping Watch" — Event Logs, Monitoring & Security Controls

Every meaningful action on a Windows system — a user logging in, a service crashing, a firewall rule blocking a connection, an account being created — gets recorded in Event Logs. They are the operating system's black box recorder, and they are the single most important data source for security monitoring and incident response.

Event logs are stored as .evtx files in C:\Windows\System32\winevt\Logs\. Each log file is a structured binary format that records events with timestamps, source identifiers, severity levels, and detailed message data. Unlike plain text log files, .evtx files support efficient querying and can be analyzed programmatically.

Windows organizes events into five primary log channels. Each serves a distinct purpose, and knowing which log to check is the first skill of effective monitoring.

Each event in the Application and System logs has a severity level that indicates its importance. The Security log uses a different classification — Audit Success and Audit Failure — since security events are about whether an action was permitted or denied, not whether something errored.

The Windows Security log can contain thousands of event types, but a handful of Event IDs are responsible for the vast majority of security-relevant information. Every security professional needs to know these by heart.

Event Viewer (eventvwr.msc) is the built-in GUI for browsing, filtering, and exporting event logs. It is the first tool most administrators reach for when investigating an issue.

Key capabilities of Event Viewer:

• Browse logs — Navigate the tree: Windows Logs (Application, Security, System, Setup, Forwarded Events) and Applications and Services Logs (more granular per-component logs)
• Filter current log — Right-click a log and select "Filter Current Log" to narrow by Event ID, time range, severity, source, or keyword. For example, filter Security log to Event ID 4625 to see only failed logons.
• Custom views — Save frequently used filters as custom views. Create a "Failed Logons" view that automatically shows only Event ID 4625 events across all domain controllers.
• Event details — Click any event to see the full XML-structured data, including the source IP address, account name, logon type, failure reason, and process information.
• Export — Save logs as .evtx (native format) or .csv/.xml for analysis in other tools.
• Attach tasks to events — Configure a task to run when a specific event occurs. For example, send an email alert whenever Event ID 1102 (log cleared) fires.

Get-WinEvent is the PowerShell cmdlet for querying event logs. It replaces the older Get-EventLog cmdlet and supports all modern log types including ETW (Event Tracing for Windows) providers.

The most important parameter is -FilterHashtable, which lets you build efficient queries that filter at the source rather than pulling all events and then filtering in the pipeline:

# Basic: Get failed logons from Security log
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625}

# Multiple Event IDs
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625,4672}

# Time range
Get-WinEvent -FilterHashtable @{
  LogName='Security'
  Id=4625
  StartTime=(Get-Date).AddDays(-7)
  EndTime=(Get-Date)
}

# Limit results
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20

# Query a remote computer
Get-WinEvent -ComputerName MD-DC01 -FilterHashtable @{LogName='Security'; Id=4625}
              

There is also wevtutil, a command-line tool for querying and managing event logs. It is faster than Get-WinEvent for large queries and supports XPath query syntax:

# Query last 5 Security events in text format
wevtutil qe Security /c:5 /f:text

# Export a log to file
wevtutil epl Security C:\Exports\security-backup.evtx

# List available logs
wevtutil el
              

Windows Defender Firewall with Advanced Security is the host-based firewall built into every Windows installation. It inspects network traffic at the operating system level and decides whether to allow or block each connection based on a set of rules.

The firewall operates with three profiles, each representing a network type. When Windows detects what type of network it is connected to, it activates the corresponding profile:

Rule evaluation follows a strict order:

1. Explicit Block rules are checked first. If a block rule matches, the packet is dropped immediately.
2. Explicit Allow rules are checked next. If an allow rule matches, the packet is permitted.
3. If no rule matches, the default action applies. For inbound traffic, the default is Block. For outbound traffic, the default is Allow.

Firewall logging can be enabled per profile to record all allowed and dropped connections. Logs are written to C:\Windows\System32\LogFiles\Firewall\pfirewall.log. This is invaluable for detecting unauthorized connection attempts.

Windows Defender Antivirus (now called Microsoft Defender Antivirus) is the built-in endpoint protection platform. It provides real-time protection against malware, ransomware, and other threats.

Key components:

• Real-time protection — Scans files as they are opened, downloaded, or executed. Intercepts threats before they can run.
• Cloud-delivered protection — Sends suspicious file metadata to Microsoft's cloud for analysis against the latest threat intelligence.
• Behavior monitoring — Watches running processes for suspicious behavior patterns (like encrypting files rapidly, which indicates ransomware).
• Tamper protection — Prevents attackers or malware from disabling Defender via registry changes or command-line tools.

Scan types:

Encryption protects data when a device is lost, stolen, or physically accessed by an unauthorized person. Windows provides two encryption technologies that operate at different levels:

AppLocker controls which applications users are allowed to run. Instead of trying to block known malware (blacklisting), AppLocker flips the model: only explicitly approved applications can execute (whitelisting). This is far more effective because attackers constantly create new malware, but the list of legitimate applications changes slowly.

AppLocker supports three types of rules:

AppLocker applies to executables (.exe, .com), scripts (.ps1, .bat, .cmd, .vbs, .js), Windows Installer files (.msi, .msp), DLLs (.dll, .ocx), and packaged apps (.appx). It is configured through Group Policy and available on Enterprise and Education editions of Windows.