topic Which one to choose Windows xml OR non-xml format to save licensing in Getting Data In

Which one to choose Windows xml OR non-xml format to save licensing

smith_ — Fri, 15 Dec 2023 07:20:47 GMT

Hi,

In our environment, we utilize Windows security logs for our security purposes. To reduce licensing costs, I'm considering switching the render XML setting to false. I'm wondering if this is advisable, especially given our focus on security use cases. Could you highlight the major distinctions between using XML and non-XML formats for these logs?

Thanks.

Re: Which one to choose Windows xml OR non-xml format to save licensing

PickleRick — Fri, 15 Dec 2023 11:22:25 GMT

While I didn't do comparison tests myself, the general consensus is that XML-rendered windows logs are the better choice. They do not cause problems with parsing (there were some problems with ambiguous data in the traditionally formated data I recall vaguely; probably more experienced with older versions colleagues could tell you more). Also they tend to be actually smaller than traditionally formatted logs.

Re: Which one to choose Windows xml OR non-xml format to save licensing

smith_ — Fri, 15 Dec 2023 12:42:12 GMT

@PickleRick ,

My aim is to save the license. Can you assist me in blacklisting some of the most common Windows security events

Re: Which one to choose Windows xml OR non-xml format to save licensing

PickleRick — Fri, 15 Dec 2023 15:06:55 GMT

Sorry, can't help you here. I'm not a windows expert.

Re: Which one to choose Windows xml OR non-xml format to save licensing

smith_ — Fri, 15 Dec 2023 15:10:22 GMT

@PickleRick ,

By any chance vpn / firewall logs ?