Windows Event Logs

Connect Windows Event Logs to Radiant Security to forward DHCP, DNS, and Windows server event logs through a Radiant Agent for AI triage.

Windows Event Logs are the structured records generated by Windows servers and workstations covering authentication, process activity, system changes, and audit policy events. Connecting Windows Event Logs forwards these events to Radiant Security through a Radiant Agent.

To send Radiant a Windows data feed not listed in this article, contact your Customer Success Manager at [e-mail].

Windows servers generate events but not alerts. If you have not connected an alert source yet, onboard one so Radiant can triage alerts in context with the event logs collected from your Windows servers.

Prerequisites

• Local Administrator access on each Windows server or workstation, or equivalent Group Policy edit rights
• A deployed Radiant Agent in the same network zone as the Windows servers

Add the data connector in Radiant Security

1. Sign in to Radiant Security.
2. From the navigation menu, click Settings > Data Connectors, then click + Add Connector.
3. Search for and select Radiant Agent, then click Data Feeds.
4. Under Select your data feeds, select the Windows event data feeds to forward to Radiant, then click Credentials.
5. Under Credential Name, enter an identifiable name for the Radiant Agent integration (e.g., Radiant Agent Integration). To reuse an existing Radiant Agent credential, select it from the drop-down menu.
6. In the Connector tag field, optionally enter any value.
7. Click Add Connector.

Configure Windows event forwarding

Each Windows server or workstation must be configured to generate the necessary audit events before the Radiant Agent can forward them. Apply the policy changes below on each system. If your organization manages security settings through Group Policy Objects (GPO), apply the same changes within the GPO to keep settings consistent across all systems and prevent domain policies from overwriting local settings.

1. Open the Local Security Policy: press Win + R, then enter secpol.msc.
2. Navigate to Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy, then enable both Success and Failure for the following policies:

   • Audit account logon events
   • Audit account management
   • Audit logon events
   • Audit privilege use
   • Audit process tracking
   • Audit policy change
3. Navigate to Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies, then configure the following:

   • Under Detailed Tracking, set Audit Process Creation to Success and Failure.
   • Under Object Access, set Audit File System to Success and Failure.
   • Under Object Access, set Audit Registry to Success and Failure.
4. Enable Windows PowerShell logging. Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell, then configure the following:

   • Under Module Logging, set to Enabled and enter * in the Module Names field to audit all modules.
   • Set PowerShell Script Block Logging to Enabled.
5. Cap the PowerShell script log size at 150 MB. Navigate to Computer Configuration > Preferences > Windows Settings > Registry, then add a new registry key (New > Registry Item) with the following values:

   • Hive: HKEY_LOCAL_MACHINE
   • Key Path: SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\ Channels\\Microsoft-Windows-PowerShell\\Operational
   • Value Name: MaxSize
   • Value Type: REG_DWORD
   • Value Data: 153616384
   • Base: Decimal
6. Click Apply.

Verify ingestion

After Windows begins forwarding, confirm events are reaching Radiant.

1. In Radiant, navigate to Log Management.
2. Filter by the rs_connectorType for each data feed you enabled:

Data feed	Filter
Microsoft Windows Application Events	rs_connectorType:"microsoft_windows_application"
Microsoft DHCP Events	rs_connectorType:"microsoft_dhcp"
Microsoft DNS Events	rs_connectorType:"microsoft_dns"
Microsoft Windows Forwarded Events	rs_connectorType:"microsoft_windows_forwarded_events"
Microsoft Windows IIS Events	rs_connectorType:"microsoft_windows_iis"
Microsoft Windows Security Events	rs_connectorType:"microsoft_windows_security"
Microsoft Windows Setup Events	rs_connectorType:"microsoft_windows_setup"
Microsoft Windows System Events	rs_connectorType:"microsoft_windows_system"

1. Confirm recent events appear for each enabled feed.

Allow several minutes for events to be parsed, indexed, and available for search.