Collecting Windows Events with the Windows Event Forwarder

WEF in one paragraph

Windows Event Forwarding (WEF) is a mechanism built into modern versions of Microsoft Windows (including Windows 10, Windows Server 2012, and more-recent releases). Events are generated on Windows systems, collected by Windows Event Collectors (WECs), and forwarded to Cribl using WEF, secured by mutual TLS, Kerberos, or Negotiate (SPNEGO) authentication. Cribl receives them through the Windows Event Forwarder Source, processes them through configured pipelines, and sends them to designated Destinations. Per that page, the Source is a Push type, supports TLS, has no Event Breaker support, and uses a key-value store.

The Cribl side

In Cribl Stream, select a Worker Group, go to Data > Sources (or Routing > QuickConnect), and add the Source. The General Settings, copied from the Source page:

Input ID: A unique name that identifies this Source.
Description: Optionally, a description.
Address: The hostname/IP on which to listen for Windows events data, for example localhost or 0.0.0.0.
Port: Defaults to 5986, the port Windows Event Collector uses for HTTPS-based subscriptions.
Authentication method: Client certificate, Kerberos, or Negotiate (SPNEGO).

For Client certificate: choose the certificate, private key path, passphrase, certificate path, and trusted client CA path, plus optional Common name regex, TLS version limits, and Verify certificate via OCSP with Strict validation. For Kerberos or Negotiate (SPNEGO), which share the same credentials: a Service principal name in this format: HTTP/<fully qualified domain name>@REALM, and a Keytab location (default /etc/krb5.keytab).

At least one subscription is required: it defines which events clients collect and how they are filtered, via Format (Raw or RenderedText), Heartbeat, Batch timeout, Locale, Read existing events, Use bookmarks, Compression, Targets (DNS names, wildcards), and per-subscription Fields. Heartbeat and Batch timeout map to the two "Event Delivery Optimization" delivery modes Windows Event Collector defines.

At least one query is required, in the XPath format Windows Event Collector uses. The doc's example collects Security events of severities Critical, Error, or Warning from the last 24 hours:

<QueryList>
          <Query Id="0" Path="Security">
            <Select Path="Security">*[System[(Level=1  or Level=2 or Level=3) and TimeCreated[timediff(@SystemTime) &lt;= 86400000]]]</Select>
          </Query>
        </QueryList>

Paste it as a Raw XML query, or use Simple mode with Path Security and the Select contents as Query expression. Add optional Persistent Queue, Processing, and Advanced Settings, then Save and Commit & Deploy.

The client side: subscriptions

The client-side steps come from the client certificate setup page. Start with the linked Microsoft WEF guide; its "non-domain" section is what the page notes correctly configures the endpoints/senders. For certificates, on-prem deployments add the server certificate and CA chain to the Worker Group and put the client certificate on Windows manually or via Group Policy auto-enrollment; Cribl.Cloud deployments upload the CA chain (the actual cert/key pair does not matter) and use /opt/criblcerts/criblcloud.crt and criblcloud.key.

Grant the service account access to the private key: in certlm.msc, right-click the client certificate, select All Tasks > Manage Private Keys..., and add NETWORK SERVICE.

The subscription itself is delivered by GPO. On a domain controller, link a GPO to the OU containing your client computers and select Configure target Subscription Manager under Administrative Templates > Windows Components > Event Forwarding (Local Group Policy Editor). The page gives one template per deployment type:

On-Prem:

Server=https://<cribl-worker-or-lb>:<wef-source-port>/wsman/SubscriptionManager/WEC,Refresh=<desired refresh interval>,IssuerCA=<CA cert fingerprint>

Cribl.Cloud:

https://<groupName>.main.<org-name>.cribl.cloud:<wef-source-port>/wsman/SubscriptionManager/WEC,Refresh=<desired refresh interval>,IssuerCA=<CA cert fingerprint>

/wsman/SubscriptionManager/WEC is the same path a WEC subscription requires and is strictly case-sensitive. IssuerCA is the SHA1 thumbprint of the issuing certificate (possibly intermediate) and must match the first certificate in the CA chain or the CA fingerprint override setting.

To let NETWORK SERVICE read the Security log: in gpedit.msc, open Event Log Service under the same templates path, double-click Security, select Configure log access, and enter:

O:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x1;;;BO)(A;;0x1;;;SO)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;S-1-5-20)

Reboot the machine, then run gpupdate /force on clients. If events do not flow, check the page's list: port 5986 (or your configured port) reachable, correct certificate chain, a valid CRL, the CA trusted on clients, server and client certs from the same CA (the CAPI2 log might reveal errors), and clean Cribl Stream and client event logs.

Kerberos mode

The Kerberos setup page covers the Kerberos and Negotiate (SPNEGO) methods, which share the same domain configuration, service principal name, and keytab and are supported only on x86_64 Linux. Its example: domain contoso.com, controller DC01.contoso.com, Worker Node worker1.contoso.com, domain user svc-stream-worker1.

Prepare the Worker Node: resolve the controller's FQDN (ping DC01.contoso.com), set the hostname to the FQDN (hostnamectl set-hostname worker1.contoso.com), synchronize the clock with the controller, and after installing krb5-user, point /etc/krb5.conf at your domain:

[libdefaults]
        default_realm = CONTOSO.COM

        [realms]
          CONTOSO.COM = {
            kdc = DC01.contoso.com
            admin_server = DC01.contoso.com
          }

        [domain_realm]
          .contoso.com = CONTOSO.COM
          contoso.com = CONTOSO.COM

Prepare the domain controller: create A and PTR records for the FQDN, create the domain user, set its password to never expire, enable both AES 128 and AES 256 Kerberos encryption options, and export the keytab from an elevated PowerShell prompt (password redacted):

ktpass /princ http/worker1.contoso.com@CONTOSO.COM /pass <your-password> /mapuser CONTOSO\svc-stream-worker1 /crypto AES256-SHA1 /ptype KRB5_NT_PRINCIPAL /out worker1.contoso.com.keytab

Copy the keytab to the Worker Node; its path becomes the Source's Keytab location. The SPN the export created (example: http/worker1.contoso.com@CONTOSO.COM) is case-sensitive and must match the export form exactly. Caveat: some newer Windows versions (such as Windows Server 2025) require the host/ SPN prefix instead of http/, so register both; if authentication fails, re-export with /princ host/worker1.contoso.com@CONTOSO.COM. Rotating the service account password requires a new keytab on each Worker Node.

Three GPOs finish the client work:

Subscription target: enable Configure target Subscription Manager, and under Subscription Managers > Show add (no IssuerCA, per the page):

Server=http://worker1.contoso.com:5985/wsman/SubscriptionManager/WEC,Refresh=60

WinRM: set the Startup type of Windows Remote Management (WS-Management) to Automatic.
NETWORK SERVICE: add it to the Event Log Readers group in Restricted Groups, then restart the computers to apply.

Set the Source's Authentication method to Kerberos (or Negotiate (SPNEGO)) with that SPN and keytab location. For these methods, Windows clients connect over http instead of https, the GPO omits IssuerCA, and Cribl Stream disables the Source's TLS settings; choose Negotiate (SPNEGO) when clients present that scheme, because left on Kerberos they reject the challenge and no events arrive.

Common setup mistakes the docs flag

The full set, grouped by page:

From the Windows Event Forwarder Source page:

In Cribl.Cloud, Kerberos and Negotiate (SPNEGO) are not supported for Cribl-managed Workers, only customer-managed ones; on Cribl Edge they require x86_64 Linux.
The CA that generated the server certificate must match the root CA that signed all client certificates; an intermediate CA must match on the server and on all client certs.
Leader CPU usage scales with the number of subscriptions and the clients per subscription; consolidate them, or enable WAL mode for the key-value store with Cribl Support.
A single XPath query covers at most about 22 EventIDs; use a structured XML query with multiple Query elements in one subscription.
Saving a changed subscription invalidates its bookmarks, so all matching events are sent again. Bookmarks are in memory: a Worker restart under a down Leader loses them, and clients balancing to another Worker can get a stale bookmark and duplicates.
With both Simple and Raw XML queries defined, only the mode selected when saving is sent; define multiple subscriptions to send both.
For these methods, keep Batch timeout and Heartbeat at or below the Keep-alive timeout (especially behind a load balancer), and set Socket timeout above the lowest Batch timeout.
Captured request headers land in __headers, which some Destinations also read for outbound behavior; remove the field in a Pipeline first or expect TLS or authentication errors.
Raising the Active request limit boosts throughput and load at once; size the deployment and Destinations first.
Smart persistent queue mode is deprecated for hybrid and on-prem Sources; affected configurations auto-migrate to Always On in January 2027.
Error 0x138C means NETWORK SERVICE cannot read the security log; "The WS-Management service cannot find the certificate that was requested" means it cannot use the private key; grant both, and review GPO permissions before editing.
"The receiver refuses to accept delivery of events and requests that the subscription be canceled" is normal during a subscription change; clients get the updated one after the Refresh interval, and refused events are resent.
If a subscription can not be created and the error code is 5004, apply the O:BAG log file permissions from the client page, then reboot the machine.
For Kerberos, verify client and destination computers are joined to a domain, and set the Subject Name format to Common name in auto-enroll templates.

From the client certificate page:

The Subscription Manager path is strictly case-sensitive; wrong capitalization makes WEF fail to forward events.
IssuerCA must match the first certificate in the Source's CA chain or the CA fingerprint override.
Reboot Windows machines after configuring Event Log Service access.

From the Kerberos page:

Kerberos and Negotiate (SPNEGO) only work on x86_64 Linux systems.
The SPN is case-sensitive and must match the keytab export; some newer Windows versions (such as Windows Server 2025) need the host/ prefix, so register both http/ and host/.
Restart the computers after the NETWORK SERVICE GPO applies.

Frequently asked questions

Which Authentication methods can the Cribl Stream Windows Event Forwarder Source use?

Client certificate (mutual TLS), Kerberos, and Negotiate (SPNEGO) are the three methods the Source supports. Kerberos and SPNEGO share one SPN and keytab, connect over http, and run only on x86_64 Linux; in Cribl.Cloud they are not supported for Cribl-managed Workers.

What port does the Windows Event Forwarder Source listen on by default?

Port 5986, which Windows Event Collector uses for HTTPS-based subscriptions. If you change the Source port, your client Subscription Manager templates must use that configured port instead.

Why does the Cribl documentation recommend structured XML queries for a WEF subscription?

A single XPath query is limited to approximately 22 EventIDs, so the docs recommend a structured XML query with multiple Query elements in one subscription, for performance and resource efficiency.

What happens when you change a subscription that Windows clients already use?

The saved bookmarks are tied to a subscription version, so a changed subscription invalidates them and all matching events are sent again. Refusals on the old subscription ID until the Refresh interval elapses are normal, and refused events are resent.

Verified against Cribl Stream 4.20 documentation on October 2, 2026.