Windows Server Integration

Overview

This integration collects Windows Security, System, Application, PowerShell, and Sysmon event logs for threat detection, Active Directory monitoring, and forensic investigation. Windows Server accounts for 60-70% of SMB server deployments in Korea and is a core requirement for ISMS-P compliance.

Supported versions: Windows Server 2016, 2019, 2022

---

Prerequisites

• A KYRA MDR Collector installed and running (Installation Guide)
• Administrator access on the Windows Server
• Network connectivity from the server to the collector on port 514

---

Configuration

Option 1: KYRA EDR Agent (Recommended)

The KYRA EDR Agent collects Windows event logs directly via the Win32 Event Log API:

# Install the KYRA EDR Agent
.\kyra-agent-installer.exe /S /COLLECTOR=KYRA_COLLECTOR_IP

The agent collects from Security, System, Application, PowerShell, and Sysmon channels automatically.

Option 2: Windows Event Forwarding (WEF)

For agentless collection, enable Windows Event Collector via Group Policy:

wecutil qc    # Enable Windows Event Collector service

Configure a subscription to forward Security events to a central collector.

Option 3: NXLog Forwarding

<Input eventlog>
    Module im_msvistalog
    Query <QueryList><Query Id="0"><Select Path="Security">*</Select></Query></QueryList>
</Input>
<Output syslog>
    Module om_udp
    Host KYRA_COLLECTOR_IP
    Port 514
</Output>
<Route eventlog_to_syslog>
    Path eventlog => syslog
</Route>

---

Collected Log Types

Event ID	Security Use	Priority
4624/4625	Logon success/failure — brute force detection	Critical
4672	Special privilege logon — admin account usage	High
4720/4726	Account created/deleted — backdoor account detection	Critical
4732	User added to admin group — privilege escalation	Critical
7045	Service installed — malicious persistence	High
4688	Process creation — suspicious execution detection	High
4768/4769	Kerberos TGT/TGS — Pass-the-Ticket attack	High
1102	Audit log cleared — evidence destruction attempt	Critical

---

Troubleshooting

No Logs Received

1. Verify the Windows Audit Policy is enabled: auditpol /get /category:*
2. Check that the KYRA EDR Agent or NXLog service is running
3. Ensure port 514 is open between the server and collector
4. For WEF, confirm the subscription is active: wecutil gs <subscription-name>

Missing Security Events

• Enable advanced audit policies via Group Policy for comprehensive event collection
• Ensure “Audit Logon Events” and “Audit Object Access” are set to Success and Failure

For additional help, contact kyra@seekerslab.com.