Event-Forwarding-Guidance is a configuration guidance repository for implementing the collection of security-relevant Windows Event Log events using Windows Event Forwarding. It serves as a companion to an NSA paper on spotting adversaries through Windows Event Log monitoring, providing a more current list of recommended events to monitor. The repository is useful with both WEF and third-party SIEM solutions as a starting point for log collection strategy. It includes recommended Windows events to collect for security monitoring, PowerShell scripts to create custom Event Log views and WEF subscriptions, and sample WEF subscriptions in XML format. Microsoft documentation on security audit policies, intrusion detection, and event logging are referenced for administrators implementing the guidance.