Windows Endpoints

Windows endpoints

For Windows servers and workstations, the only software Hal puts on an endpoint is a lightweight, userspace log shipper — a Fluent Bit forwarder that reads Windows event logs and ships them to Hal. It is not an EDR, runs no kernel driver, and has no write path back into the machine.

What’s shipped:

• The security event log — logons and logoffs, account and group changes, privilege use
• The channels and event IDs that matter for detection, with the host and the acting account

Each endpoint reports under a stable identity, so Hal can tell one machine from another over time. A bad update to a userspace log shipper can at worst stop log collection — it can never crash the machine, which is why a CrowdStrike-style outage is impossible here.

Retained 365 days, like every other source.

See also: the SIEM and read-only by architecture.