How to use the Windows Event Logging for Detection agent skill

What the skill makes the agent do

When the skill is active, the agent follows a checklist for configuring Windows Event Logging with advanced audit policies. The goal is to generate high-fidelity security events for threat detection and forensic investigation, such as logons, process starts with command lines, privilege use, and account changes.

The skill covers four areas: setting audit policies through Group Policy, enlarging the Security log, forwarding events to a central collector or SIEM, and a reference list of Windows event IDs that can signal suspicious activity. It also includes two Python scripts that read the current auditpol settings on a Windows machine and compare them with the recommended values.

How to install the Windows Event Logging for Detection skill

Download the ZIP file from this page. Unzip it into one of these locations: ~/.claude/skills/ to make the skill available to you across projects, or a project's .claude/skills/ folder to make it available only in that project.

You can also upload the skill in the Claude apps under Settings → Capabilities → Skills.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into the project's .claude/skills/ folder
• Claude apps: Settings → Capabilities → Skills, then upload

What you need before you start

The skill assumes a Windows Server or Windows 10/11 environment where you have Group Policy management access. For domain endpoints you also need Active Directory with permission to create Group Policy Objects (GPOs). The auditpol and wevtutil command-line tools are built into Windows and are used by the steps.

Forwarding steps need a SIEM configured to receive forwarded Windows events. The included scripts need Python 3.

• Windows Server or Windows 10/11 with Group Policy management access
• Active Directory with GPO creation privileges (for domain endpoints)
• A SIEM set up to receive forwarded Windows events (for forwarding steps)
• auditpol and wevtutil (built into Windows)
• Python 3 to run the included scripts

Trigger the skill with natural requests

You do not need special syntax. Describe the outcome you want in plain language. The skill is meant to activate for requests about Windows audit policy, event log configuration, security logging, or detection-oriented logging, and for enabling audit policies for logon events, process creation, privilege use and object access to feed SIEM detection rules.

Requests that fit the skill include asking how to turn on process creation auditing with command lines, how to size the Security log, or which event IDs matter for detecting lateral movement. To check the current state of your audit policy, the source shows this built-in command, which lists the advanced audit policy:

• Help me turn on command line logging for process creation events.
• Which Windows event IDs should I alert on for suspicious logons?
• Check my audit policy against the recommended settings.
• Walk me through forwarding Security events to our SIEM.

Configure audit policy and event log sizes

The skill's first step sets advanced audit policy through Group Policy at Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies. Basic and advanced audit policies conflict, so the skill recommends using advanced audit policy only.

For process creation, the skill gives a registry value and a matching GPO setting that include the command line in Event 4688. The Security log default of 20 MB is described as too small, and the skill recommends at least 1 GB, which it sets with wevtutil.

• Enable Process Creation with Success auditing, and Logon with Success and Failure.
• Enable the 'Include command line in process creation events' policy under Administrative Templates → System → Audit Process Creation.
• Set the Security log maximum to 1 GB (1073741824 bytes); the skill also sets the PowerShell Operational log to 512 MB.
• Test broad auditing in a non-production environment first, because it can flood logs and fill storage.

Forward events to a central collector or SIEM

The skill describes Windows Event Forwarding (WEF), which collects logs centrally without third-party agents. It lists high-value event IDs for a subscription, including 4624, 4625, 4688, 4672, 4720, 4728, 7045 and 1102. Source endpoints need WinRM and an event forwarding setting that points to the collector's Subscription Manager.

The skill also names NXLog and Winlogbeat as log forwarding agents, and the Palantir WEF configuration as a set of open-source subscription templates. Local logs can be lost when an endpoint is wiped, so the skill recommends forwarding to a centralized SIEM.

• Collector: run wecutil qc /q
• Endpoints: run winrm quickconfig and set the target Subscription Manager through Event Forwarding policy
• Forward first, then verify the events arrive in the SIEM

Use the reference list of Windows event IDs

The skill groups event IDs by purpose so you can build detection rules. Examples include 4624 (successful logon, with logon types such as 2 for interactive, 3 for network and 10 for remote interactive), 4625 (failed logon), 4688 (process creation), 4720 (user account created), 7045 (new service installed) and 1102 (audit log cleared).

Some IDs are combined as indicators. For example, 4648 together with a Type 3 4624 is listed as a credential-based lateral movement indicator. Treat these as starting points for rules, not verdicts.

• Authentication: 4624, 4625, 4648, 4672, 4776
• Process: 4688, 4689
• Accounts: 4720, 4722, 4724, 4728, 4732, 4756
• Service and system: 7045, 1102, 4697
• Lateral movement indicators: 4648 with 4624 Type 3, 5140, 5145

Check your settings with the included scripts

The two Python scripts in the skill read the current auditpol settings on a Windows machine and compare them with the recommended values. Use them to find gaps after you apply Group Policy, or to review a machine you did not configure yourself.

The skill also includes a configuration template for recording audit policy, log sizes and sign-off, which you can use to track each machine's status.

• Run the scripts on a Windows machine with Python 3 installed.
• Review the comparison output before changing any policy.
• Record the status for each setting in the template.