---
url: https://docs.realmsec.info/integration/windows-event-logs.md
---

# Windows Event Logs

Realm Security integrates seamlessly with Windows Event Logs, enabling intelligent routing and analysis of security event logs.

Realm supports two approaches for collecting Windows Event Logs:

* **[Approach 1 — Realm Collector via WEF/WEC](#approach-1-realm-collector-via-wef-wec):** Use Windows Event Forwarding to centralise logs on a WEC server, then install the Realm Collector on that server to poll the Forwarded Events channel.
* **[Approach 2 — Syslog via NXLog or similar](#approach-2-syslog-via-nxlog-or-similar):** Use a log shipper such as NXLog to convert Windows Event Logs to XML (new line delimited) and forward them over TCP to a Realm Collector stream.

***

## Approach 1: Realm Collector via WEF/WEC

### Data Flow

```text
Windows Endpoint → via (WEF) Windows Event Forwarder → Windows Event Collector Server (WEC) VM → Realm Data Collector (running on same VM as WEC) → Realm Cloud
```

Use Windows Event Forwarder to collect logs from all endpoints/servers to a Windows Event Collector Server (WEC). Install the Realm Data Collector on the WEC VM. The Realm Data Collector will collect logs from the Forwarded Event channel.

#### Setup Windows Event Logs Source in Realm

1. Login to Realm console.
2. Go to **Sources > Add > Windows Event Logs (XML)** and add a new Source.
   > **Name:** `Windows Event Logs`
   > **Description:** `Windows Event Logs`
3. If a collector is already set up, go to **Collectors** and select your collector. If not, [add a new collector](/integration/collector).
4. Add a Windows Event Logs stream to the Collector. Click **Add Stream**.
   > **Product Format:** `Windows Event Logs (XML)`
   > **Source:** `Windows Event Logs`
   > **Stream Type:** `Windows Local`\
   > **Polling Interval:** Configure the poll interval of your choosing, or use the default of 5 seconds.
   > **Max Reads:** Configure the maximum number of events to read per polling interval, or use the default of 100 events.
5. Click **Add Stream**.

### Prerequisites

* Ensure you have administrative access to your Windows machine.
* Realm Collector is set up and running. See [Realm Collector install guide](/integration/collector) for setting up a collector.

### Windows Event Forwarder

Follow this guide to configure Windows Event Forwarder:
[Setting up a Source-Initiated Subscription](https://learn.microsoft.com/en-us/windows/win32/wec/setting-up-a-source-initiated-subscription)

### References

* [Use Windows Event Forwarding to assist in intrusion detection](https://learn.microsoft.com/en-us/windows/security/operating-system-security/device-management/use-windows-event-forwarding-to-assist-in-intrusion-detection)
* [Windows Event Collector](https://learn.microsoft.com/en-us/windows/win32/wec/windows-event-collector)

***

## Approach 2: Syslog via NXLog or Similar

### Data Flow

```text
Windows Endpoint → NXLog (XML) → TCP → Realm Collector stream → Realm Cloud
```

This approach is useful when you are already running a log shipper such as NXLog and want to forward events directly to the Realm Collector without setting up a WEC server. Events are converted to XML delimited by new lines and sent over TCP.

### Step 1: Create a Source in Realm

1. In Realm, go to **Sources > Add Source**.
2. Enter a name for your source.
3. Set **Product Format** to **Windows Event Logs (XML)**.
4. Click **Save**.

### Step 2: Add a Collector Stream

1. On the **Select Transport Method** step in the Add Source flow, select **Collector** > create a new collector or select an existing one > click **Continue** to add a stream.

> **Note:** Alternatively, create a stream from the **Collectors** page by selecting a collector and clicking **Add Stream**.

2. Configure the collector stream:
   * **Name:** Give the stream a name.
   * **Stream Type:** Select **TCP**.
   * **Port:** Use the preconfigured port or change it to suit your environment (e.g., `1514`).
   * **Framing Trailer:** Select the framing trailer that matches your NXLog output (typically newline `\n`).
3. Click `Create Stream`.
4. Note the **Collector IP address** and **Port** — you will need these in the NXLog configuration.

### Step 3: Configure NXLog

Here is a sample NXLog config file `nxlog.conf` to export Windows Event Logs as XML over raw TCP stream. Replace `<collector_ip>` and `<collector_port>` with the values from Step 2.
Ensure that the XML logs are sent over raw TCP stream to the collector, not wrapped inside a syslog wrapper.

**XML format (recommended):**

```ini
<Extension _xml>
    Module    xm_xml
</Extension>

<Input eventlog>
    Module    im_msvistalog
</Input>

<Output realm_tcp>
    Module      om_tcp
    Host        <collector_ip>
    Port        <collector_port>
    Exec        $raw_event = to_xml(); $raw_event =~ s/[\r\n\t]+/ /g;
    OutputType  LineBased
</Output>

<Route r>
    Path      eventlog => realm_tcp
</Route>
```

### References

* [NXLog: Converting Windows Event Log to syslog-encapsulated XML](https://docs.nxlog.co/agent/current/xm/xml.html#example2)
* [NXLog: Forward Windows events logs](https://docs.nxlog.co/integrations/os/windows-event-log.html)
* [NXLog Community Edition documentation](https://docs.nxlog.co/ce/current/)