How to get logs from a Windows machine without installing a forwarder?

[mmensch]

Hi,

I understand that best practice is to install a universal forwarder on a server and send the logs directly to an indexer. However, if I have a circumstance that I cannot install the forwarder on a Windows machine, what would be my options on how to get logs into Splunk?

I've heard of something built into Windows such as WinEventLog forwarding, but I can't seem to find much documentation on it.

Thanks.

[spayneort · Accepted solution]

You could collect the remote logs using WMI (not recommended), or use native Windows Event Forwarding to send the logs to a different server where you are able to install the universal forwarder.

Event Forwarding info:

Splunk blog post
http://blogs.splunk.com/2014/02/03/forwarding-windows-event-logs-to-another-host/

Microsoft blog post and presentation
https://blogs.technet.microsoft.com/jepayne/2015/11/23/monitoring-what-matters-windows-event-forward...

The NSA put out a document called "Spotting the Adversary with Windows Event Log Monitoring" that covers Event Forwarding.