{"id":18645,"date":"2021-09-27T15:06:37","date_gmt":"2021-09-27T15:06:37","guid":{"rendered":"https:\/\/kalilinuxtutorials.com\/?p=18645"},"modified":"2021-09-27T15:06:42","modified_gmt":"2021-09-27T15:06:42","slug":"qlog","status":"publish","type":"post","link":"https:\/\/kalilinuxtutorials.com\/qlog\/","title":{"rendered":"QLOG : Windows Security Logging"},"content":{"rendered":"\n

QLOG <\/strong>provides enriched Event Logging for security related events on Windows based systems. It is under heavy development and currently in alpha state. QLOG doesn\u2019t use API hooks and it doesn\u2019t require a driver to be installed on the target system, QLOG only uses ETW to retrieve its telemetry. Currently QLOG supports \u201cprocess create\u201d events only, but other enriched events will follow soon. QLOG runs as a Windows Services, but can also run in console mode, if you want to stream the enriched events to console directly.<\/p>\n\n\n\n

<\/a>How Does It Work<\/strong><\/p>\n\n\n\n

QLOG reads from ETW, enriches events and writes enriched events to Event Channel \u201cQLOG\u201d. It creates and uses a new event source named \u201cQMonitor\u201d to write to Windows Eventlog.<\/p>\n\n\n\n

Here is sequence of event processing:<\/p>\n\n\n\n