Using subscriptions, this Windows capability sends event log entries from source machines to a collector server. CEF and syslog are not things it can receive.
Also called WEF.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Windows Event Forwarding in context, with comparison tables and the common traps.
Terms in this definition
- Capability
Something that a person, organisation or system is able to do.
- Event log
Two different things share the name. A Lakeflow pipeline writes one you can query for progress, lineage and data quality metrics; a compute resource has an Event log tab showing its lifecycle, for example resizing or losing spot nodes, kept for 60 days.
- CEF
Format for text logs sent over syslog by firewalls and similar devices. A Linux log forwarder passes these messages to Microsoft Sentinel, which stores them in
CommonSecurityLog. - Syslog
Table in Log Analytics holding syslog messages from Linux.