WELA (Windows Event Log Auditor) ゑ羅

[ English ] | [日本語]

---

About WELA

WELA (Windows Event Log Analyzer, ゑ羅) is a tool for auditing Windows event log settings. Windows event logs are a vital source of information for Digital Forensics and Incident Response (DFIR), providing visibility into system activity and security events. Unfortunately, default configurations often lead to problems such as limited log retention, insufficient audit policies, and blind spots that reduce detection capability. WELA helps uncover these weaknesses and offers practical recommendations to improve audit settings and enhance security visibility. WELA also assesses log configurations based on real-world Sigma rule coverage, allowing users to evaluate what can or cannot be detected under current the settings.

Companion Projects

• EnableWindowsLogSettings: Yamato Security's Windows Event Log Configuration Guide.
• EventLog-Baseline-Guide: A tool to visualize detection gaps in Sigma rules and major guides.
• WELA-RulesGenerator: A tool for generating WELA's Sigma rule-related config files.

Table of Contents

• About WELA
• Companion Projects
• Table of Contents
• Screenshots
  • Startup Help Menu
  • audit-settings (terminal output)
  • audit-settings (GUI)
  • audit-settings (table)
  • audit-filesize
• Features
• Prerequisites
• Downloads
• Running WELA
• Command List
• Command Usage
  • audit-settings
    • audit-settings command examples
  • audit-filesize
    • audit-filesize command examples
  • update-rules
    • update-rules command examples
• Other Windows Event Log Audit Settings Related Resources
• Contributions
• Bug Submission
• License
• Contributors
• Acknowledgements
• Twitter

Screenshots

Startup Help Menu

audit-settings (terminal output)

audit-settings (GUI)

audit-settings (table)

audit-filesize

Features

• Auditing Windows event log audit policy settings.
• Checking based on the major Windows event log audit configuration guidelines.
• Checking Windows event log audit settings based on real-world Sigma rule detectability.
• Auditing of Windows event log file sizes and suggestions for the recommended size.

Prerequisites

• Windows PowerShell 5.1 or PowerShell Core
• Running PowerShell with Administrator privileges

Downloads

Please download the latest stable version of WELA from the Releases page.

Running WELA

1. Unzip the release zip file.
2. Open PowerShell with Administrator privileges.
3. ./WELA.ps1 help to run WELA and see the help usage.

Command List

• audit-settings: Check Windows event log audit policy settings.
• audit-filesize: Check Windows event log file size.
• update-rules: Update WELA's Sigma rules config files.

Command Usage

audit-settings

The audit-settings command checks the Windows event log audit policy settings and compares them with the recommended settings from Yamato Security, Microsoft(Sever/Client), and Australian Signals Directorate (ASD). RuleCount indicates the number of Sigma rules that can detect events within that category.

audit-settings command examples

Check with the default Yamato Security's recommended settings and save results to CSV:

./WELA.ps1 audit-settings

Check with the Australian Signals Directorate's recommended settings and save results to CSV:

./WELA.ps1 audit-settings -BaseLine ASD

Check with Microsoft's recommended Server OS settings and display results in a GUI:

./WELA.ps1 audit-settings -BaseLine Microsoft_Server -OutType gui

Check with Microsoft's recommended Client OS settings and display results in table format:

./WELA.ps1 audit-settings -BaseLine Microsoft_Client -OutType table

audit-filesize

The audit-filesize command checks the Windows event logs' file size and compares them with the recommended settings from Yamato Security's recommendations.

audit-filesize command examples

Check the Windows event log file size with Yamato Security's recommendations and save results to CSV:

./WELA.ps1 audit-filesize

update-rules

update-rules command examples

Update WELA's Sigma rules config files:

./WELA.ps1 update-rules

Other Windows Event Log Audit Settings Related Resources

• A Data-Driven Approach to Windows Advanced Audit Policy – What to Enable and Why
• Audit Policy Recommendations
• Configure audit policies for Windows event logs
• EnableWindowsLogSettings
• Windows event logging and forwarding
• mdecrevoisier/Windows-auditing-baseline
• palantir/windows-event-forwarding

Contributions

We would love any form of contribution. Pull requests are the best, but feature requests notifying us of bugs, etc... through issues are also very welcome.

At the least, if you like our tools and resources, then please give us a star on GitHub and show your support!

Bug Submission

• Please submit any bugs you find here.
• This project is currently actively maintained, and we are happy to fix any bugs reported.

License

• WELA is released under the MIT License.

Contributors

• Fukusuke Takahashi (core developer)
• Zach Mathis (project leader, tool design, testing, etc...) (@yamatosecurity)

Acknowledgements

• Australian Cyber Security Centre: Windows event logging and forwarding
• Microsoft: Advanced security auditing FAQ
• SigmaHQ

Twitter

You can receive the latest news about WELA, rule updates, other Yamato Security tools, etc... by following us on Twitter at @SecurityYamato.