Context and scope
Centralised Windows/Linux logging architecture, secure collection, archiving and monitoring integration.
Work performed
- Separate collection, storage, archiving and event analysis.
- Configure Windows Event Forwarding, subscriptions, collectors and firewalls.
- Deploy WinRM/WEF through GPO and restrict log-reading permissions.
- Integrate Linux logs and prepare analysis in Splunk.
Documented deliverables and outcomes
Monitoring architecture; Windows procedures; WEF/WinRM/GPO settings; Linux flows; collection and archiving chain.
Scope of outcomes
The reviewed public documents describe the work and deliverables above. They do not provide a quantified before/after series supporting a risk-reduction percentage here.
Methods and tools
WEF · WinRM · Active Directory / GPO · Rsyslog · Splunk
Public scope
Client data, exploitable configurations and proprietary mechanisms remain excluded from this presentation.
Last reviewed: 26 October 2026
Discuss this work