<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-endpoint-logging-configuration
description: >-
  Configure comprehensive endpoint logging using Sysmon, Windows Event
  Forwarding, auditd, and osquery. Covers log source configuration, event
  forwarding to SIEM, retention policies, and validation of logging
  pipeline integrity.
domain: cybersecurity
subdomain: endpoint-security
tags:
  - logging
  - sysmon
  - wef
  - auditd
  - osquery
  - siem-forwarding
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
    - T1562.002
    - T1070.001
    - T1070.002
---

# Implementing Endpoint Logging Configuration

## Overview

Comprehensive endpoint logging provides the visibility required for detection,
hunting, and forensic analysis. Configuration must balance completeness against
volume and performance. The logging pipeline includes generation (Sysmon, auditd),
collection (WEF, Filebeat), forwarding (to SIEM), and retention management.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Sysmon | Windows process-level telemetry |
| Windows Event Forwarding | Centralized Windows log collection |
| auditd | Linux syscall and file access auditing |
| osquery | Cross-platform endpoint querying |
| Filebeat / Winlogbeat | Log shippers for SIEM forwarding |

## Workflow

1. **Assess requirements** — Identify detection use cases and required log sources
2. **Configure Sysmon** — Deploy optimized config (SwiftOnSecurity or Olaf Hartong)
3. **Configure auditd** — Deploy audit rules for file access, process execution, network
4. **Set up WEF** — Configure Windows Event Forwarding subscriptions
5. **Deploy log shippers** — Install Filebeat/Winlogbeat for SIEM forwarding
6. **Configure retention** — Set local log sizes and SIEM retention policies
7. **Validate pipeline** — Generate test events and verify they reach SIEM
8. **Monitor health** — Alert on log gaps, stopped services, or delivery failures

## Key Commands

```bash
# Sysmon — Install with config
sysmon64 -accepteula -i sysmonconfig-export.xml

# Sysmon — Update config
sysmon64 -c sysmonconfig-export.xml

# Sysmon — Verify running
sc query Sysmon64
sysmon64 -c  # dump current config

# Windows Event Forwarding — Create subscription
wecutil cs subscription.xml

# Windows Event Forwarding — Check status
wecutil gs "ForwardedEvents"

# auditd — Load rules
augenrules --load
auditctl -l  # list active rules

# auditd — Key rules
auditctl -w /etc/passwd -p wa -k passwd_changes
auditctl -w /etc/shadow -p wa -k shadow_changes
auditctl -a always,exit -F arch=b64 -S execve -k exec_log

# osquery — Interactive query
osqueryi "SELECT * FROM processes WHERE name = 'sshd';"

# osquery — Schedule query via config
cat /etc/osquery/osquery.conf

# Validate Sysmon events reaching SIEM
Get-WinEvent -LogName 'Microsoft-Windows-Sysmon/Operational' -MaxEvents 1

# Validate auditd events
ausearch -k exec_log --start today -i | head
```

## Verification

| Check | Method |
|---|---|
| Sysmon running | `sc query Sysmon64` returns RUNNING |
| Sysmon config loaded | `sysmon64 -c` shows expected rule count |
| auditd rules active | `auditctl -l` shows expected rules |
| WEF subscription active | `wecutil gs` shows active subscription |
| SIEM receiving events | Test event appears in SIEM within 60 seconds |
| osquery scheduled | `osqueryctl config-check` passes |

## References

- [SwiftOnSecurity Sysmon Config](https://github.com/SwiftOnSecurity/sysmon-config)
- [Olaf Hartong Sysmon Modular](https://github.com/olafhartong/sysmon-modular)
- [auditd Rule Reference](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/security_hardening/auditing-the-system_security-hardening)
- [osquery Documentation](https://osquery.readthedocs.io/)

---
v1.0 | Validated: 2026-03-18
