# Event Viewer & Windows Security Logs

> Master Windows logging and monitoring. Explore Event Viewer architecture, critical Security Event IDs, PowerShell logging, and how to integrate logs with a SIEM for threat hunting.

Canonical: https://codelivly.com/rooms/event-viewer-windows-security-logs
Last updated: 2026-07-02

| | |
|---|---|
| Level | Beginner |
| Category | Cybersecurity |
| Lessons | 4 |
| Estimated time | 30 min |
| XP | 200 |

Dive into the central nervous system of Windows observability. The Event Viewer & Windows Security Logs module breaks down how Windows records system activity, user actions, and security events.

You will learn the architecture of the Windows Event Log service, navigate the Event Viewer interface, and identify the most critical Security Event IDs for detecting initial access, lateral movement, and privilege escalation. We will also cover PowerShell Script Block Logging and how to forward logs to a SIEM for centralized threat hunting. By the end of this module, you will know how to extract, analyze, and monitor Windows logs to uncover hidden attacker activity.

## Lessons

1. Event Viewer & Windows Event Log Architecture (30 min)
2. Critical Security Event IDs (30 min)
3. PowerShell Script Block Logging & Transcripti (30 min)
4. Log Retention, Forwarding, and SIEM Integrati (30 min)

## Related

- [Learning path: Windows Fundamentals](https://codelivly.com/learning-paths/windows-fundamentals)
- [All rooms](https://codelivly.com/rooms)