Windows Server
Windows servers send event data to the platform through an agent on the host — most commonly NXLog — which reads the Windows Event Log and forwards it as syslog to a collector or cloud syslog endpoint. This page groups the Windows-side setup guides.
In this section
- Windows Active Directory — installing NXLog on domain controllers, enabling DHCP audit logging, and a complete sample
nxlog.conf(plain and TLS). - Windows Sysmon — installing Microsoft Sysmon with a sample configuration and forwarding its channel via NXLog.
Install the Application
The host-side pages below cover getting Windows events out via NXLog. The platform side is one template: go to Platform → Applications → Install Application From Template and choose Windows Server w/ NXLog from the Endpoint Management category. Both parameters are required:
| Parameter | Notes |
|---|---|
| datalake | Pre-filled managed. |
| datalake index name | Pre-filled WindowsAudit. Two applications writing to the same index name in the same lake will collide, and the second one aborts. |
The template supplies the parser, so there is no processor to write. The transport is configured on the syslog listener rather than on this form. Press Install; the application then appears in the Installed Applications view, where its badge reads Running once the pipeline is up.
Related
- Data Collection — transports and collectors.
- Syslog Ports — where the forwarded data lands.
- Windows NXLog parser cookbook — for customising the parsing the template ships with.