Mind the Gaps: Detecting What You Miss in Windows Event Logs (and Fixing It!)

No ratings

Presented at CODE BLUE 2025 by

Fukusuke Takahashi

Zach Mathis

Windows Event Logs play a critical role in DFIR. However, default audit settings often lead to detection blind spots due to limited log sizes, insufficient policies, and short retention. We present two open-source tools that help defenders assess and improve Windows Event Log audit settings for stronger threat detection and forensic readiness. WELA is a PowerShell-based tool that audits current settings against industry best practices and real-world Sigma rule coverage. By leveraging over 4,000 Sigma rules, it reveals what threats can or cannot be detected and supports multiple audit guide. EventLog-Baseline-Guide is a Streamlit-based web application for visualizing differences in audit policies across baseline guides. It uses intuitive color coding and maps audit settings to Sigma rule coverage by log source and event type. Together, these tools empower security teams to close visibility gaps in Windows logging and make informed, data-driven improvements to their DFIR posture.