{"id":684,"date":"2021-06-21T19:08:06","date_gmt":"2021-06-21T18:08:06","guid":{"rendered":"https:\/\/www.seven-stones.biz\/blog\/?p=684"},"modified":"2021-06-21T19:08:08","modified_gmt":"2021-06-21T18:08:08","slug":"siem-windows-events-quick-win","status":"publish","type":"post","link":"https:\/\/www.seven-stones.biz\/blog\/siem-windows-events-quick-win\/","title":{"rendered":"SIEM – Windows Events Quick Win"},"content":{"rendered":"\n

There has been a modicum of interest in a Windows spreadsheet I shared on social media recently, that if absorbed and acted upon, can be a early no-brainer win with SIEM products that are licensed based on volume or Events Per Second (EPS). <\/p>\n\n\n\n

Its no big secret that Windows machines, virtual or real, are noisy. Clients I worked with – I would estimate 90%, for various reasonsdon’t act on the noise from Windows devices and it’s costing them a fortune (right or wrong, approx 50% of those prioritise other tasks). <\/p>\n\n\n\n

In Splunk, one can use searches to estimate the benefit of removing noisy Windows events, and what I found was quite a broad range of results. It makes little sense to give the full breakdown because the result depends heavily on the spread and amount of Windows to other Operating Systems (OS). But there were a couple of cases where logging events volume was reduced by 70%. <\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

Some points to note:<\/p>\n\n\n\n