Which one to choose Windows xml OR non-xml format to save licensing

[smith_]

Hi,

In our environment, we utilize Windows security logs for our security purposes. To reduce licensing costs, I'm considering switching the render XML setting to false. I'm wondering if this is advisable, especially given our focus on security use cases. Could you highlight the major distinctions between using XML and non-XML formats for these logs?

Thanks.

[PickleRick]

While I didn't do comparison tests myself, the general consensus is that XML-rendered windows logs are the better choice. They do not cause problems with parsing (there were some problems with ambiguous data in the traditionally formated data I recall vaguely; probably more experienced with older versions colleagues could tell you more). Also they tend to be actually smaller than traditionally formatted logs.

[smith_]

@PickleRick ,

My aim is to save the license. Can you assist me in blacklisting some of the most common Windows security events

[PickleRick]

Sorry, can't help you here. I'm not a windows expert.

[smith_]

@PickleRick ,

By any chance vpn / firewall logs ?