palantir/windows-event-forwarding

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1342 stars · 278 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Palantir-maintained repository of Windows Event Forwarding (WEF) subscriptions and guidance for centrally collecting security-relevant event logs from Windows hosts. It provides building blocks to deploy WEF in production for incident detection and response.

Use cases

• centralize windows event logs for security monitoring
• detect malware persistence via event subscriptions
• alert on log deletion and suspicious service account access
• deploy agent-free log forwarding across a windows domain
• build detection rules on forwarded windows events
• monitor access to sensitive filesystem and registry locations

When to choose

• you run a Windows domain and want agent-free centralized event log collection
• you need forensic and security event data for incident detection and response
• you want community-maintained WEF subscription templates to start quickly

When to avoid

• your fleet is mostly non-Windows
• you need cross-platform log shipping with rich transformation (consider dedicated log agents)
• you have no Windows Event Collector infrastructure or Active Directory domain

Facets

application · maturity active

monitoring alerting logging security security monitoring windows windows self-hosted windows-event-forwarding wef incident-response detection subscriptions log-collection devops

Member repositories

For agents

markdown · JSON · MCP: product_card(name="palantir/windows-event-forwarding")