palantir · novaksam · Mar 22, 2019
diff --git a/wec-registry-tweaks/README.md b/wec-registry-tweaks/README.md
@@ -0,0 +1,48 @@
+# WEC-Registry-Tweaks
+
+In high volume environments, it may be necessary to increase memory buffers for heavy intake Subscriptions. 
+Applying these registry files will increase the buffers available for the Windows event collector, but has the possibility of exhausting system resources.
+Once rebooted, you can look at the [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\[Event-Channel]\{[Provider-Guid]}\Status] entry to determine if the resources were allocated successfully (0) or if the system doesn't have enough resources (1450)
+
+## Contents of Registry Files
+
+```
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\[Event-Channel]]
+"Guid"="{[Unique-Guid]}"
+"BufferSize"=dword:00000100
+"FlushTimer"=dword:00000000
+"MaximumBuffers"=dword:00000400
+"MinimumBuffers"=dword:00000000
+"OwningChannel"="[Event-Channel]"
+"Start"=dword:00000001
+
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\[Event-Channel]\{[Provider-Guid]}]
+"Enabled"=dword:00000001
+```
+
+### Descriptions
+
+* Guid - Unique Per Subscription
+REG_SZ
+A string that contains a GUID that uniquely identifies the session. This value is required.
+* BufferSize - Default to 256 (256KB)
+REG_DWORD
+The size of each buffer, in kilobytes. Should be less than one megabyte. ETW uses the size of physical memory to calculate this value.
+* FlushTimer - Default to 0
+REG_DWORD
+How often, in seconds, the trace buffers are forcibly flushed. The minimum flush time is 1 second. This forced flush is in addition to the automatic flush that occurs when a buffer is full and when the trace session stops. For the case of a real-time logger, a value of zero (the default value) means that the flush time will be set to 1 second. A real-time logger is when LogFileMode is set to EVENT_TRACE_REAL_TIME_MODE.The default value is 0. By default, buffers are flushed only when they are full. 
+* MaximumBuffers - Default to 1024 buffers (Defaults to 256MB Maximum per buffer)
+REG_DWORD
+The maximum number of buffers to allocate. Typically, this value is the minimum number of buffers plus twenty. ETW uses the buffer size and the size of physical memory to calculate this value. This value must be greater than or equal to the value for MinimumBuffers.
+* MinimumBuffers
+REG_DWORD
+The minimum number of buffers to allocate at startup. The minimum number of buffers that you can specify is two buffers per processor. For example, on a single processor computer, the minimum number of buffers is two.
+* Start
+REG_DWORD
+To have the AutoLogger session start the next time the computer is restarted, set this value to 1; otherwise, set this value to 0.
+
+
+
+## Helpful Resources
+* [Microsoft WMI Autologger documentation](https://docs.microsoft.com/en-us/windows/desktop/etw/configuring-and-starting-an-autologger-session)
+* [Windows Event Forwarding into HP/ArchSight at Scale](https://community.softwaregrp.com/dcvta86296/attachments/dcvta86296/arcsight-discussions/24729/1/Protect2015-WindowsEventForwarding.pdf)
diff --git a/wec-registry-tweaks/WEC-Authentication.reg b/wec-registry-tweaks/WEC-Authentication.reg
diff --git a/wec-registry-tweaks/WEC-Code-Integrity.reg b/wec-registry-tweaks/WEC-Code-Integrity.reg
diff --git a/wec-registry-tweaks/WEC-Powershell.reg b/wec-registry-tweaks/WEC-Powershell.reg
diff --git a/wec-registry-tweaks/WEC-Process-Execution.reg b/wec-registry-tweaks/WEC-Process-Execution.reg
diff --git a/wec-registry-tweaks/WEC-Services.reg b/wec-registry-tweaks/WEC-Services.reg
diff --git a/wec-registry-tweaks/WEC-WMI.reg b/wec-registry-tweaks/WEC-WMI.reg
diff --git a/wec-registry-tweaks/WEC2-Application-Crashes.reg b/wec-registry-tweaks/WEC2-Application-Crashes.reg
diff --git a/wec-registry-tweaks/WEC2-Applocker.reg b/wec-registry-tweaks/WEC2-Applocker.reg
diff --git a/wec-registry-tweaks/WEC2-Group-Policy-Errors.reg b/wec-registry-tweaks/WEC2-Group-Policy-Errors.reg
diff --git a/wec-registry-tweaks/WEC2-Object-Manipulation.reg b/wec-registry-tweaks/WEC2-Object-Manipulation.reg
diff --git a/wec-registry-tweaks/WEC2-Registry.reg b/wec-registry-tweaks/WEC2-Registry.reg
diff --git a/wec-registry-tweaks/WEC2-Task-Scheduler.reg b/wec-registry-tweaks/WEC2-Task-Scheduler.reg
diff --git a/wec-registry-tweaks/WEC2-Windows-Defender.reg b/wec-registry-tweaks/WEC2-Windows-Defender.reg
diff --git a/wec-registry-tweaks/WEC3-Account-Management.reg b/wec-registry-tweaks/WEC3-Account-Management.reg
diff --git a/wec-registry-tweaks/WEC3-Drivers.reg b/wec-registry-tweaks/WEC3-Drivers.reg
diff --git a/wec-registry-tweaks/WEC3-External-Devices.reg b/wec-registry-tweaks/WEC3-External-Devices.reg
diff --git a/wec-registry-tweaks/WEC3-Firewall.reg b/wec-registry-tweaks/WEC3-Firewall.reg
diff --git a/wec-registry-tweaks/WEC3-Print.reg b/wec-registry-tweaks/WEC3-Print.reg
diff --git a/wec-registry-tweaks/WEC3-Smart-Card.reg b/wec-registry-tweaks/WEC3-Smart-Card.reg
diff --git a/wec-registry-tweaks/WEC3-Windows-Diagnostics.reg b/wec-registry-tweaks/WEC3-Windows-Diagnostics.reg
diff --git a/wec-registry-tweaks/WEC4-Bits-Client.reg b/wec-registry-tweaks/WEC4-Bits-Client.reg
diff --git a/wec-registry-tweaks/WEC4-DNS.reg b/wec-registry-tweaks/WEC4-DNS.reg
diff --git a/wec-registry-tweaks/WEC4-Hotpatching-Errors.reg b/wec-registry-tweaks/WEC4-Hotpatching-Errors.reg
diff --git a/wec-registry-tweaks/WEC4-Shares.reg b/wec-registry-tweaks/WEC4-Shares.reg
diff --git a/wec-registry-tweaks/WEC4-System-Time-Change.reg b/wec-registry-tweaks/WEC4-System-Time-Change.reg
diff --git a/wec-registry-tweaks/WEC4-Windows-Updates.reg b/wec-registry-tweaks/WEC4-Windows-Updates.reg
diff --git a/wec-registry-tweaks/WEC4-Wireless.reg b/wec-registry-tweaks/WEC4-Wireless.reg
diff --git a/wec-registry-tweaks/WEC5-Autoruns.reg b/wec-registry-tweaks/WEC5-Autoruns.reg
diff --git a/wec-registry-tweaks/WEC5-Certificate-Authority.reg b/wec-registry-tweaks/WEC5-Certificate-Authority.reg
diff --git a/wec-registry-tweaks/WEC5-Crypto-API.reg b/wec-registry-tweaks/WEC5-Crypto-API.reg
diff --git a/wec-registry-tweaks/WEC5-Log-Deletion-Security.reg b/wec-registry-tweaks/WEC5-Log-Deletion-Security.reg
diff --git a/wec-registry-tweaks/WEC5-Log-Deletion-System.reg b/wec-registry-tweaks/WEC5-Log-Deletion-System.reg
diff --git a/wec-registry-tweaks/WEC5-MSI-Packages.reg b/wec-registry-tweaks/WEC5-MSI-Packages.reg
diff --git a/wec-registry-tweaks/WEC5-Operating-System.reg b/wec-registry-tweaks/WEC5-Operating-System.reg
diff --git a/wec-registry-tweaks/WEC6-ADFS.reg b/wec-registry-tweaks/WEC6-ADFS.reg
diff --git a/wec-registry-tweaks/WEC6-Device-Guard.reg b/wec-registry-tweaks/WEC6-Device-Guard.reg
diff --git a/wec-registry-tweaks/WEC6-Duo-Security.reg b/wec-registry-tweaks/WEC6-Duo-Security.reg
diff --git a/wec-registry-tweaks/WEC6-Exploit-Guard.reg b/wec-registry-tweaks/WEC6-Exploit-Guard.reg
diff --git a/wec-registry-tweaks/WEC6-Microsoft-Office.reg b/wec-registry-tweaks/WEC6-Microsoft-Office.reg
diff --git a/wec-registry-tweaks/WEC6-Software-Restriction-Policies.reg b/wec-registry-tweaks/WEC6-Software-Restriction-Policies.reg
diff --git a/wec-registry-tweaks/WEC6-Sysmon.reg b/wec-registry-tweaks/WEC6-Sysmon.reg
diff --git a/wec-registry-tweaks/WEC7-Active-Directory.reg b/wec-registry-tweaks/WEC7-Active-Directory.reg
diff --git a/wec-registry-tweaks/WEC7-Privilege-Use.reg b/wec-registry-tweaks/WEC7-Privilege-Use.reg
diff --git a/wec-registry-tweaks/WEC7-Terminal-Services.reg b/wec-registry-tweaks/WEC7-Terminal-Services.reg