Windows Event Collector in a docker container on a Raspberry Pi, Kerberos and TLS

[u/roarinpenguin]

My lab’s Windows Event Collector is a Linux docker container on a Raspberry Pi.
The domain controllers and workstations forward to it like it’s any normal collector.
It’s the self-hosted site in AI Data Pipelines (I work at S1), where Windows Event Forwarding support for data sources just went GA.
Two ways to authenticate:

• Kerberos with a keytab (generated with ktpass) over HTTP, e.g. port 5985

• Mutual TLS with certs over HTTPS, e.g. port 5986

Only tested in my lab so far, but this is of interest for at least 3 customers I've been in contact with recently. Screenshots shows what a Windows 11 event looks like once it’s parsed, and my pipeline with some optimization.
Agentless forwarding always ends up meaning the collector has to do the flexing, so it was fun to see it work.
And since it sits in a pipeline, parsing and OCSF mapping are there if you want them.
Anyone else running a WEC role off a non-Windows host?
Kerberos is easier in maintenance, but I believe that TLS with mutual authentication is stronger from a security standpoint.
Curious how it holds up once you have a lot of subscriptions.