---
title: "Windows hosts"
url: "https://axoflow.com/docs/axoflow/0.86/data-sources/appliances/microsoft/windows/"
last_modified: "2026-02-04T13:31:42+01:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axoflow/0.86/llms.txt).

# Windows hosts

Windows hosts:
Event logs from core services like security, system, DNS, and DHCP for operational and forensic analysis.

To collect event logs from Microsoft Windows hosts, Axoflow supports both agent-based and agentless methods.

- For a collector agent, we recommend using the Axoflow OpenTelemetry Collector distribution. For details, see [Windows host - agent based solution](https://axoflow.com/docs/axoflow/0.86/provisioning/windows-opentelemetry/index.md).
- To use an agentless solution, see [Windows Event Collector (WEC)](https://axoflow.com/docs/axoflow/0.86/data-sources/wec/index.md).

## Labels

Labels assigned to data received from Windows hosts depend on how AxoRouter receives the data. For details, see [Windows host - agent based solution](https://axoflow.com/docs/axoflow/0.86/provisioning/windows-opentelemetry/index.md#labels) and [Windows Event Collector (WEC)](https://axoflow.com/docs/axoflow/0.86/data-sources/wec/index.md#labels).

## Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

| sourcetype | index |
| --- | --- |
| `windows:eventlog:snare` | `oswin` |
| `windows:eventlog:xml` | `oswin` |

If the Axoflow classification doesn’t set the source field for the message automatically, and you haven’t set it in a [flow processing step](https://axoflow.com/docs/axoflow/0.86/data-management/processing/index.md#set-fields) manually (by setting the `meta.destination.splunk.source` field), AxoRouter automatically sets the source to the [name of the AxoRouter connector](https://axoflow.com/docs/axoflow/0.86/reference/message-schema/reference/index.md#meta.connector.name) that received the message (for example, `axorouter-syslog-tcp-514`).

## Sending data to Google SecOps

When sending the data collected from this source to a [*dynamic* Google SecOps destination](https://axoflow.com/docs/axoflow/0.86/destinations/google/secops/index.md), Axoflow sets the following log type: `WINEVTLOG, WINEVTLOG_XML, WINDOWS_DHCP, WINDOWS_DNS`.

## Sending data to Microsoft Sentinel

When sending the data collected from this source to a [Microsoft Sentinel destination](https://axoflow.com/docs/axoflow/0.86/destinations/microsoft/sentinel/index.md), Axoflow normalizes the data and sends it to the following tables.

- Event logs from the Security channel: `SecurityEvent`
- Event logs from the System channel: `SecurityEvent`
- Other event logs: `WindowsEvent`