How to enable event collection in Windows Server
SIEM and SOAR allow enterprises to collect and correlate log event data but may not be the ideal choice for every organization. Microsoft’s Windows Event Forwarding aggregates system event logs from disparate systems.
Group Policy Object Windows Powershell Remoting Or Admin Center Windows Event Forwarding Windows Remote Management Windows Powershell Remoting Windows Admin
Source: csoonline.com