# Windows Events

| Platform | Metrics | Logs | Traces |
| -------- | ------- | ---- | ------ |
| Windows  |         | ✓    |        |

### **Prerequisites for Remote Configuration**

**Supported Versions:**

* Windows Vista or later

**Minimum Setup Requirements:**

* **User Permissions:**
  * The user must be a member of the `Event Log Readers` group.
  * The user must have DCOM and WMI permissions for remote access.
* **Firewall Configuration:**
  * Ensure the firewall rules allow the necessary ports: TCP 135, 445, and dynamic RPC ports (49152-65535).
* **Windows Firewall Exception:**
  * Enable the "Remote Event Log Management" exception on the remote machine.

### **Configuration Table**

**Windows Event Log Receiver**

<table><thead><tr><th width="221.18359375">Parameter</th><th width="93.16015625">Type</th><th width="75.5625">Default</th><th>Description</th></tr></thead><tbody><tr><td>system_event_input</td><td>bool</td><td>true</td><td>Enable the System event channel.</td></tr><tr><td>app_event_input</td><td>bool</td><td>true</td><td>Enable the Application event channel.</td></tr><tr><td>security_event_input</td><td>bool</td><td>true</td><td>Enable the Security event channel.</td></tr><tr><td>suppress_rendering_info</td><td>bool</td><td>false</td><td>When this is enabled, the source will not attempt to resolve rendering info. This can improve performance but comes at a cost of losing some details in the event log.</td></tr><tr><td>custom_channels</td><td>strings</td><td></td><td>Custom channels to read events from.</td></tr></tbody></table>

**Remote Configuration Options**

<table><thead><tr><th width="162.52734375">Parameter</th><th width="93.1796875">Type</th><th width="80.62109375">Default</th><th>Description</th></tr></thead><tbody><tr><td>remote.server</td><td>string</td><td></td><td>The server to connect to for remote event logs.</td></tr><tr><td>remote.username</td><td>string</td><td></td><td>The username to authenticate with the server.</td></tr><tr><td>remote.password</td><td>string</td><td></td><td>The password to authenticate with the server.</td></tr><tr><td>remote.domain</td><td>string</td><td></td><td>The domain of the server (optional).</td></tr></tbody></table>

**SID Resolution Options**

<table><thead><tr><th width="208.046875">Parameter</th><th width="87.4140625">Type</th><th width="95.7578125">Default</th><th>Description</th></tr></thead><tbody><tr><td>resolve_sids.enabled</td><td>bool</td><td>false</td><td>Enable Security Identifier (SID) resolution. When enabled, SID values in event logs (e.g., S-1-5-18) are resolved to human-readable account names (e.g., NT AUTHORITY\SYSTEM)</td></tr><tr><td>resolve_sids.cache_size</td><td>uint</td><td>10000</td><td>Maximum number of resolved SIDs to cache. Increase for environments with many unique accounts.</td></tr><tr><td>resolve_sids.cache_ttl</td><td>duration</td><td>15m</td><td>How long resolved SID entries are cached before re-lookup. Lower values detect account changes faster; higher values reduce API calls.</td></tr></tbody></table>

When SID resolution is enabled, the following Event data fields are added to log records (added alongside any field ending in Sid, such as SubjectUserSid or TargetUserSid):

* {FieldName}\_Resolved - Fully qualified name (e.g., NT AUTHORITY\SYSTEM)
* {FieldName}\_Domain - Domain name
* {FieldName}\_Account - Account name
* {FieldName}\_Type - Account type

Common well-known SIDs (such as SYSTEM, BUILTIN\Administrators, LOCAL SERVICE, etc.) are resolved locally without requiring network calls. All other SIDs are resolved via the Windows LSA API, which automatically contacts the domain controller for domain-joined machines.

If a SID cannot be resolved (invalid format, lookup failure), the original SID value is preserved, and processing continues normally. No events are dropped.

### Custom Channels

To find the value for the custom channel name you can run the following commands on the Windows Server to find the value of the custom channel log name:\
`Get-WinEvent -ListLog *`


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.bindplane.com/integrations/sources/windows-events.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.