microsoft / microsoft/winget-cli
Log WinGet Actions in Event Viewer
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 26.4k
- Forks
- 1.8k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 15
Description
I've looked under ideas but couldn't find any similar idea.
From a secops and enterprise management point of view it would be much more valuable that any winget actions are logged into the event viewer. Ideally in it's own dedicated eventlog, if not possible I would say the standard application log but with its own event source.
This would enable a lot of scenario's from forwarding events with tools like splunk or even Defender for endpoint to be able to collect those events. But it also would allow better troubleshooting and being able to track the history and it would even allow to attach tasks to certain events.
Thanks,
Kris Titeca
Originally posted by @KrisTiteca in https://github.com/microsoft/winget-cli/discussions/3119
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by examining the WinGet CLI action entry points and its existing logging, then review how Windows Event Viewer supports a dedicated event log or application event source. Define which WinGet actions and event fields must be recorded, and confirm that the resulting events can support troubleshooting and collection by Splunk or Defender for Endpoint.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- cli, observability, operating-systems, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100