# Windows Remote Collection

| Platform | Metrics | Logs | Traces |
| -------- | ------- | ---- | ------ |
| Windows  |         | ✓    |        |

### Configuration Table

#### Remote Connection

<table><thead><tr><th width="162.52734375">Parameter</th><th width="93.1796875">Type</th><th>Description</th></tr></thead><tbody><tr><td>remote.server</td><td>string</td><td>The server to connect to for remote event logs.</td></tr><tr><td>remote.username</td><td>string</td><td>The username to authenticate with the server.</td></tr><tr><td>remote.password</td><td>string</td><td>The password to authenticate with the server.</td></tr><tr><td>remote.domain</td><td>string</td><td>The domain of the server (optional).</td></tr></tbody></table>

#### Channels and Collection

<table><thead><tr><th width="221.18359375">Parameter</th><th width="93.16015625">Type</th><th width="75.5625">Default</th><th>Description</th></tr></thead><tbody><tr><td>query_mode</td><td>enum</td><td>Channels</td><td>Querying mode to use. Valid values are <code>Channels</code> and <code>XML</code>. When set to <code>Channels</code>, choose from a list of preconfigured channels to collect from. When set to <code>XML</code>, specify channels and event filtering using an XML QueryList to target specific events.</td></tr><tr><td>system_event_input</td><td>bool</td><td>true</td><td>Enable the System event channel.</td></tr><tr><td>app_event_input</td><td>bool</td><td>true</td><td>Enable the Application event channel.</td></tr><tr><td>security_event_input</td><td>bool</td><td>true</td><td>Enable the Security event channel.</td></tr><tr><td>forwarded_events_input</td><td>bool</td><td>false</td><td>Enable the ForwardedEvents channel.</td></tr><tr><td>powershell_event_input</td><td>bool</td><td>false</td><td>Enable the Windows PowerShell event channel.</td></tr><tr><td>sysmon_input_channel</td><td>bool</td><td>false</td><td>Enable the Microsoft-Windows-Sysmon/Operational channel.</td></tr><tr><td>dns_server_event_input</td><td>bool</td><td>false</td><td>Enable the Microsoft-Windows-DNSServer/Operational channel.</td></tr><tr><td>mssql_event_input</td><td>bool</td><td>false</td><td>Collect Microsoft SQL Server events from the Application channel. Captures events from the Database Engine, SQL Agent, Analysis Services, Reporting Services, Integration Services, and Full-Text Filter Daemon for the configured instances.</td></tr><tr><td>mssql_instance_name</td><td>strings</td><td>MSSQLSERVER</td><td>The SQL Server instance names to collect events from.</td></tr><tr><td>custom_channels</td><td>strings</td><td></td><td>Custom channels to read events from.</td></tr><tr><td>query</td><td>xml</td><td></td><td>XML QueryList used to filter events being processed.</td></tr><tr><td>start_at</td><td>enum</td><td>end</td><td>Start reading logs from <code>beginning</code> or <code>end</code>.</td></tr><tr><td>collection_mode</td><td>enum</td><td>Streaming</td><td>Collection mode to use. When set to <code>Streaming</code>, the source streams events as they arrive. When set to <code>Polling</code>, the source polls for new events at a fixed interval.</td></tr><tr><td>polling_interval</td><td>float</td><td>5</td><td>The interval (seconds) at which the channel is checked for new log entries.</td></tr><tr><td>wait_timeout</td><td>float</td><td>5</td><td>Maximum duration (seconds) to wait for new events before performing a safety-net poll.</td></tr><tr><td>raw_logs</td><td>bool</td><td>true</td><td>When enabled, the XML log is not parsed into a structure but instead saved to the log body.</td></tr><tr><td>event_data_format</td><td>enum</td><td>map</td><td>Sets the format used to express Event Data in the parsed log body. Options are 'map' or 'array'. Only exposed if <code>raw_logs</code> is false.</td></tr><tr><td>suppress_rendering_info</td><td>bool</td><td>true</td><td>When this is enabled, the source will not attempt to resolve rendering info. This can improve performance but comes at a cost of losing some details in the event log.</td></tr><tr><td>include_log_record_original</td><td>bool</td><td>true</td><td>When enabled, the original log record is included in the log body.</td></tr><tr><td>ignore_channel_errors</td><td>bool</td><td>true</td><td>When enabled, prevents shutdown of collector when failing to open channels, and instead logs a warning.</td></tr><tr><td>enable_file_offset_storage</td><td>bool</td><td>true</td><td>When enabled, the current position in the Windows Events will be saved to disk, and reading will resume from where it left off after a collector restart.</td></tr><tr><td>offset_storage_directory</td><td>string</td><td>${OIQ_OTEL_COLLECTOR_HOME}/storage</td><td>The directory that the offset storage file will be created in.</td></tr><tr><td>enable_retry_on_failure</td><td>bool</td><td>true</td><td>Attempt to resend telemetry data that has failed to be transmitted to the destination.</td></tr><tr><td>retry_on_failure_initial_interval</td><td>int</td><td>1</td><td>Time (in seconds) to wait after the first failure before retrying.</td></tr><tr><td>retry_on_failure_max_interval</td><td>int</td><td>30</td><td>The upper bound (in seconds) on backoff.</td></tr><tr><td>retry_on_failure_max_elapsed_time</td><td>int</td><td>300</td><td>The maximum amount of time (in seconds) spent trying to send a batch, used to avoid a never-ending retry loop.</td></tr></tbody></table>

#### **SID Resolution Options**

<table><thead><tr><th width="208.046875">Parameter</th><th width="87.1875">Type</th><th width="95.7578125">Default</th><th>Description</th></tr></thead><tbody><tr><td>resolve_sids.enabled</td><td>bool</td><td>false</td><td>Enable Security Identifier (SID) resolution. When enabled, SID values in event logs (e.g., S-1-5-18) are resolved to human-readable account names (e.g., NT AUTHORITY\SYSTEM)</td></tr><tr><td>resolve_sids.cache_size</td><td>uint</td><td>10000</td><td>Maximum number of resolved SIDs to cache. Increase for environments with many unique accounts.</td></tr><tr><td>resolve_sids.cache_ttl</td><td>duration</td><td>15m</td><td>How long resolved SID entries are cached before re-lookup. Lower values detect account changes faster; higher values reduce API calls.</td></tr></tbody></table>

When SID resolution is enabled, the following Event data fields are added to log records (added alongside any field ending in Sid, such as SubjectUserSid or TargetUserSid):

* {FieldName}\_Resolved - Fully qualified name (e.g., NT AUTHORITY\SYSTEM)
* {FieldName}\_Domain - Domain name
* {FieldName}\_Account - Account name
* {FieldName}\_Type - Account type

Common well-known SIDs (such as SYSTEM, BUILTIN\Administrators, LOCAL SERVICE, etc.) are resolved locally without requiring network calls. All other SIDs are resolved via the Windows LSA API, which automatically contacts the domain controller for domain-joined machines.

If a SID cannot be resolved (invalid format, lookup failure), the original SID value is preserved, and processing continues normally. No events are dropped.

### Custom Channels

To find the value for a custom channel name, you can run the following command on the Windows Server:\
`Get-WinEvent -ListLog *`


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.bindplane.com/integrations/sources/windows-remote-collection.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.