https://www.giac.org/paper/gsec/2085/practical-implementation-syslog-mixed-windows-environments-secure-centralized-audit-logging/103572