Skip to content

Windows Log Insight


Microsoft Windows is a popular operating system developed by Microsoft since 1985.

It's available in three variants:

  • Windows for desktop/laptop computers, tablets and smartphones
  • Windows Server for servers
  • Windows PE as a lightweight version.

Event Categories

The following table lists the data source offered by this integration.

Data Source Description
Access tokens security identifiers are extracted from several events
Authentication logs audit logon events are examined in detail


As of now, the main solution to collect Windows logs with Log Insight leverages the Rsyslog recipe. Please share your experiences with other recipes by editing this documentation.


Please refer to the documentation of Linux to forward events to your rsyslog server. The reader can consult the Rsyslog Transport documentation to forward these logs to