Docs cut: one-screen README, 13 pages to 10, Sentinel KQL to extras

.coderabbit.yaml

@@ -38,7 +38,7 @@ reviews:
   path_instructions:
     - path: "**/*.ps1"
       instructions: |
-        House rules for this repo (see README "Contributing and SDLC"):
+        House rules for this repo (see CONTRIBUTING.md):
         - Must run on stock Windows PowerShell 5.1: no ternary operator, no
           null-coalescing (??), no null-conditional (?.), no pwsh-only cmdlets
           or parameters. Flag anything 7-only.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -14,8 +14,8 @@ body:
     attributes:
       label: Proposed behaviour
       description: >-
-        What should happen instead. Check ROADMAP.md first - it may already
-        be planned.
+        What should happen instead. Check the open issues first - it may
+        already be planned.
     validations:
       required: true
   - type: checkboxes

.github/workflows/docs.yml

@@ -8,6 +8,8 @@ on:
     paths:
       - 'docs/**'
       - 'mkdocs.yml'
+      # The home page includes README.md through a snippet.
+      - 'README.md'
       - '.github/workflows/docs.yml'
   workflow_dispatch:
 

.github/workflows/release.yml

@@ -28,7 +28,7 @@ jobs:
           $tag = '${{ github.ref_name }}'
           $stage = "WinLogKit-$tag"
           New-Item -ItemType Directory -Path $stage | Out-Null
-          Copy-Item *.ps1, PSScriptAnalyzerSettings.psd1, README.md, ROADMAP.md, CHANGELOG.md, LICENSE $stage
+          Copy-Item *.ps1, PSScriptAnalyzerSettings.psd1, README.md, CHANGELOG.md, LICENSE $stage
           # Data-dependent scripts (coverage mapping, presets) must work from
           # the zip, not only from a git clone.
           Copy-Item data, presets, tools, tests, addons $stage -Recurse

CHANGELOG.md

@@ -3,6 +3,23 @@
 All notable changes to WinLogKit. Versions follow [SemVer](https://semver.org/);
 releases are tagged `vX.Y.Z` and published with a zip + SHA256 checksum.
 
+## Unreleased
+
+### Changed
+- **Docs cut.** README reduced to one screen and reused as the site home
+  page (MkDocs snippet include, one copy of the text). The site goes from
+  13 pages to 10: the WEC Collector page absorbs the WEF section of
+  Deployment and becomes **Collect**, Architecture merges into
+  **Coverage**, FAQ merges into **Safety & FAQ**, and the Sentinel KQL
+  page moves to `docs/extras/` outside the navigation (the kit is
+  SIEM-agnostic; that page is one worked example of the last hop).
+  Landing-page hero and card styling removed.
+- `ROADMAP.md` removed; planned work is tracked in GitHub issues. The
+  release zip no longer ships it.
+- FAQ: the Sysmon answer now covers built-in Sysmon on Windows 11 and
+  Windows Server 2025 (an optional Windows feature since February 2026,
+  per [Microsoft's Sysmon overview](https://learn.microsoft.com/windows/security/operating-system-security/sysmon/overview)).
+
 ## v0.11.0 - 2026-09-04
 
 ### Added

CONTRIBUTING.md

@@ -14,7 +14,7 @@ is what tunes the presets. Open an issue with the *Field report* template.
   Use the *Bug report* template and include the transcript from `.\Logs\`
   or the Results CSVs where relevant.
 - **Docs** - unclear wording, missing steps, broken links.
-- **Code** - fixes and roadmap items ([ROADMAP.md](ROADMAP.md)). For
+- **Code** - fixes and planned work (open issues labelled `enhancement`). For
   anything non-trivial, open an issue first so the approach is agreed
   before you spend time on it.
 

README.md

@@ -3,152 +3,105 @@
 [![CI](https://github.com/spydisec/WinLogKit/actions/workflows/ci.yml/badge.svg)](https://github.com/spydisec/WinLogKit/actions/workflows/ci.yml)
 [![Release](https://img.shields.io/github/v/release/spydisec/WinLogKit?include_prereleases)](https://github.com/spydisec/WinLogKit/releases)
 [![Docs](https://img.shields.io/badge/docs-spydisec.github.io%2FWinLogKit-1b3a4b)](https://spydisec.github.io/WinLogKit/)
-[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
-
-**An easy, auditable way to implement the
-[Yamato Security](https://github.com/Yamato-Security) Windows event logging
-baselines with native PowerShell.** Enable the right event channels, advanced
-audit policy subcategories and registry settings; verify them repeatably; and
-get an independent second opinion from
-[WELA](https://github.com/Yamato-Security/WELA) - all with plain
-PowerShell: PowerShell 7 or the built-in Windows PowerShell 5.1, no
-modules, no agents, no Sysmon.
-
-Targets **Windows Server 2019 / 2022 / 2025 and Windows 10 / 11**, standalone
-or domain joined. Version-specific items (Server 2025 / Win11 24H2 SMB
-auditing) and role-specific items (domain controller subcategories) are
-detected at runtime and reported NOT APPLICABLE where they don't apply.
-Fleet delivery via **Intune remediations**, **WEF/WEC subscriptions** and
-**GPO artefacts** is built in, and the kit reports which **MITRE ATT&CK**
-techniques a selection makes observable.
-
-## 📖 Documentation
-
-**<https://spydisec.github.io/WinLogKit/>** - getting started, baseline
-guide, per-command reference, deployment (Intune / WEF / GPO), ATT&CK
-coverage, the full [per-setting reference
-table](https://spydisec.github.io/WinLogKit/reference/) (every event ID,
-size, volume weight and baseline membership), safety notes and FAQ.
-
-## Credits
-
-The settings themselves come from Yamato Security's excellent work:
-
-- [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) -
-  the configuration guide and batch script this kit operationalises
-- [WELA](https://github.com/Yamato-Security/WELA) - used here as an
-  independent verification tool
-- [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide) -
-  the source of the ASD / Microsoft Client / Microsoft Server reference
-  baselines shipped as presets
-
-This project is not affiliated with or endorsed by Yamato Security. A handful
-of deliberate deviations from their scripts are
-[documented with reasons](https://spydisec.github.io/WinLogKit/baselines/#deviations-from-the-yamato-sources).
-
-## ⚠️ Warning
-
-Same warning as the upstream guide: understand and **test every setting on a
-non-production machine that mirrors your environment for at least a week**
-before rolling out. Logging volume is real money and real disk. Use at your
-own risk.
-
-## Files
-
-| File | What it does |
-|---|---|
-| `LoggingBaseline.Settings.ps1` | Single source of truth: every channel, subcategory and registry value with tier, scope, purpose and risk notes. Everything else derives from it. |
-| `New-LoggingBaseline.ps1` | Interactive baseline builder: walk every setting, see the recommendation and risk, write selections to CSV. No admin, changes nothing. |
-| `Enable-LoggingBaseline.ps1` | Applies a baseline. Idempotent, `-WhatIf` diff, `-Rollback` to first-run state, pre-change snapshots, never reboots or shrinks logs. |
-| `Test-LoggingBaseline.ps1` | Verification only: PASS / FAIL / NOT APPLICABLE per category, CSVs to `.\Results\`, non-zero exit on failure for pipelines. |
-| `Invoke-WELACheck.ps1` | Runs WELA as an independent second opinion, parses deviations, archives evidence per run. |
-| `New-IntuneRemediationPack.ps1` | Compiles a selection into a self-contained Intune detect + remediate script pair. |
-| `New-WefSubscription.ps1` | Generates a source-initiated WEF subscription XML plus collector/source setup steps. `-Filter Baseline` narrows Security to the event IDs the baseline's subcategories produce; `-Validate` parses every query locally. |
-| `Test-WefFilter.ps1` | On the collector: proves the subscription filter is in effect from ForwardedEvents evidence, and that the deployed query is the generated one. |
-| `New-GpoPack.ps1` | Generates GPO delivery artefacts: `audit.csv` (GUID-driven) and LGPO-format `registry.txt`. |
-| `Export-AttackCoverage.ps1` | Reports which ATT&CK techniques a selection makes observable, and why the rest are not. |
-| `presets/` | Ready-made selection CSVs: ASD / Microsoft reference baselines, per-role starting points, and the blended **spydi** baselines (role x volume). |
-| `addons/AutorunsToWinEventLog/` | **Optional add-on** (needs Sysinternals autorunsc): daily task writing every autostart entry to an `Autoruns` event log, a daily inventory over the native Persistence gap. Inspired by Palantir's tool (MIT, credited). |
-| `tests/Invoke-KitChecks.ps1` | Self-checks CI runs on PowerShell 5.1 and 7; run locally before a PR. |
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://github.com/spydisec/WinLogKit/blob/main/LICENSE)
+
+Turn on the Windows event logging that security monitoring needs, prove it
+is being recorded, and roll it back if you change your mind. Plain
+PowerShell (7 or the built-in 5.1), no modules, no agents.
+
+The baselines are built from the [Yamato Security](https://github.com/Yamato-Security)
+logging guides, the Australian Signals Directorate and Microsoft's own
+recommendations, with every setting's purpose, volume risk and source
+recorded in one table. Targets Windows Server 2019 / 2022 / 2025 and
+Windows 10 / 11, standalone or domain-joined; version- and role-specific
+items are detected at runtime and reported NOT APPLICABLE where they do not
+apply.
+
+## What it does
+
+- **Enable** event channels, advanced audit policy subcategories and
+  registry settings from one settings table. Idempotent, `-WhatIf` diff,
+  `-Rollback` to first-run state.
+- **Verify** the live state per behaviour category (PASS / FAIL / NOT
+  APPLICABLE) with evidence CSVs, plus Yamato's WELA as an independent
+  second opinion.
+- **Collect** centrally: a Windows Event Forwarding subscription generated
+  from the same selection. It forwards the selected channels whole by
+  default, or narrows Security to the event IDs the baseline actually
+  produces. The kit ends at the collector's ForwardedEvents log; any SIEM
+  picks up from there.
+- **Deploy** at fleet scale as an Intune remediation pack or GPO artefacts,
+  compiled from the same table so deployed config cannot drift from the
+  tested baseline.
+- **Measure** which MITRE ATT&CK techniques a selection makes observable,
+  offline, from data shipped in the kit.
 
 ## Quick start
 
-All commands from an elevated PowerShell prompt in the kit folder -
-PowerShell 7 or the built-in Windows PowerShell 5.1 both work
-(`New-LoggingBaseline.ps1` alone needs no elevation). If scripts are blocked,
-`Set-ExecutionPolicy -Scope Process RemoteSigned` unblocks the current window
-without persisting anything
-([details](https://spydisec.github.io/WinLogKit/getting-started/#if-scripts-are-blocked-running-scripts-is-disabled-on-this-system)).
-
-**Path A - tier switches** (fastest route to the recommended baseline):
+From an elevated PowerShell prompt in the kit folder. Test on a
+non-production machine that mirrors your environment for at least a week
+before rolling out: logging volume is real disk and real money.
 
 ```powershell
-.\Enable-LoggingBaseline.ps1 -WhatIf         # 1. full diff, nothing changed
-.\Enable-LoggingBaseline.ps1                 # 2. apply Core (first run captures rollback state)
-.\Enable-LoggingBaseline.ps1 -IncludeHighVolume  # 3. after reviewing the volume notes
-.\Test-LoggingBaseline.ps1   -IncludeHighVolume  # 4. verify what you applied
-.\Invoke-WELACheck.ps1 -Download             # 5. independent second opinion
-.\Enable-LoggingBaseline.ps1 -Rollback       # if needed: put everything back
+.\Enable-LoggingBaseline.ps1 -WhatIf              # 1. full diff, nothing changes
+.\Enable-LoggingBaseline.ps1                      # 2. apply Core (first run captures rollback state)
+.\Test-LoggingBaseline.ps1                        # 3. verify
+.\Enable-LoggingBaseline.ps1 -IncludeHighVolume   # 4. add the high-volume tier after reading its notes
+.\Enable-LoggingBaseline.ps1 -Rollback            # undo everything captured at step 2
 ```
 
-**Path B - build your own baseline** (decide setting-by-setting, or start
-from a preset):
+Want your own selection? `.\New-LoggingBaseline.ps1` walks every setting
+and writes a CSV that Enable, Test, the coverage report and every fleet
+generator accept through `-BaselineFile`; `presets\` ships ready-made
+ones (ASD, Microsoft, and the kit's own `spydi_*` Minimal / Heavy pairs
+per role).
 
-```powershell
-.\New-LoggingBaseline.ps1                    # interactive walk-through -> MyBaseline.csv
-.\Enable-LoggingBaseline.ps1 -BaselineFile .\MyBaseline.csv -WhatIf
-.\Enable-LoggingBaseline.ps1 -BaselineFile .\MyBaseline.csv
-.\Test-LoggingBaseline.ps1   -BaselineFile .\MyBaseline.csv
-```
+If scripts are blocked, `Set-ExecutionPolicy -Scope Process RemoteSigned`
+unblocks the current window without persisting anything; downloaded zips
+also need `Unblock-File`, and a policy enforced by Group Policy cannot be
+overridden locally (signing or a policy change is needed). Details in
+[Getting Started](https://spydisec.github.io/WinLogKit/getting-started/#if-scripts-are-blocked-running-scripts-is-disabled-on-this-system).
 
-Press `t` during the walk-through (or use `-Show`) for a tree view of the
-selection with per-category coverage. The CSV is plain text: commit one per
-server role and you get reviewable, versioned logging baselines for free.
-Presets work anywhere a `-BaselineFile` is accepted:
+## Documentation
 
-```powershell
-.\Enable-LoggingBaseline.ps1 -BaselineFile .\presets\spydi_Workstation_Minimal.csv -WhatIf
-```
+Full documentation: <https://spydisec.github.io/WinLogKit/>
 
-## Tiers
-
-| Tier | Applied when | Contents |
-|---|---|---|
-| Core | always | Everything with low or justified volume |
-| HighVolume | `-IncludeHighVolume` | Process Creation + command line, PowerShell script block + module logging, Filtering Platform Connection, Sensitive Privilege Use |
-| Optional | `-IncludeOptional` | PowerShell transcription, Crypto-DPAPI debug channel, IPsec Driver auditing |
+| Page | Covers |
+|---|---|
+| [Getting Started](https://spydisec.github.io/WinLogKit/getting-started/) | Install, first run, execution policy, where output lands |
+| [Baselines](https://spydisec.github.io/WinLogKit/baselines/) | Tiers, presets, deviations from the sources |
+| [Commands](https://spydisec.github.io/WinLogKit/commands/) | Every script and its switches |
+| [Collect](https://spydisec.github.io/WinLogKit/wec/) | WEF / WEC: subscription, collector and source setup, XPath filtering |
+| [Deploy](https://spydisec.github.io/WinLogKit/deployment/) | Intune and GPO rollout |
+| [Coverage](https://spydisec.github.io/WinLogKit/mapping/) | How the pieces fit, behaviour categories, ATT&CK technique coverage |
+| [Reference](https://spydisec.github.io/WinLogKit/reference/) | Every setting: event IDs, sizes, volume, preset membership |
+| [Safety & FAQ](https://spydisec.github.io/WinLogKit/safety/) | Never-do list, volume impact, known limits, common questions |
+| [Add-ons](https://spydisec.github.io/WinLogKit/addons/) | AutorunsToWinEventLog (optional, needs Sysinternals autorunsc) |
 
 ## Safety
 
 The kit never touches the settings that can hang or lock out a host
 (`CrashOnAuditFail`, "do not overwrite" retention, global object access
 auditing, blanket SACLs) and never reboots, restarts services or shrinks
-logs. Merely *heavy* settings carry a risk note the builder shows before you
-select them. Full rationale, the volume-impact table and known limits:
-[Safety](https://spydisec.github.io/WinLogKit/safety/).
-
-## Where everything else lives
-
-| Topic | Docs page |
-|---|---|
-| Install, first run, execution policy | [Getting Started](https://spydisec.github.io/WinLogKit/getting-started/) |
-| Tiers, presets, spydi blended baselines | [Baselines](https://spydisec.github.io/WinLogKit/baselines/) |
-| Every switch of every script, WELA reference | [Commands](https://spydisec.github.io/WinLogKit/commands/) |
-| Intune, WEF/WEC, GPO rollout | [Deployment](https://spydisec.github.io/WinLogKit/deployment/) |
-| ATT&CK technique coverage and method | [Coverage](https://spydisec.github.io/WinLogKit/mapping/) |
-| Per-setting table: event IDs, sizes, volume, baseline membership | [Reference](https://spydisec.github.io/WinLogKit/reference/) |
-| How the pieces fit, behaviour category mapping | [Architecture](https://spydisec.github.io/WinLogKit/architecture/) |
-| Never-do list, volume impact, known limits | [Safety](https://spydisec.github.io/WinLogKit/safety/) |
-| Workstations, Home edition, common questions | [FAQ](https://spydisec.github.io/WinLogKit/faq/) |
+logs. Heavy settings carry a risk note the builder shows before you select
+them. Use at your own risk.
 
 ## Contributing
 
-Issues and PRs welcome - especially field reports on real event volumes per
-setting. See [CONTRIBUTING.md](CONTRIBUTING.md) for how changes land
-(branch + PR, CI gates, release process), [SECURITY.md](SECURITY.md) for
-reporting vulnerabilities, and [ROADMAP.md](ROADMAP.md) for what's planned.
-Changes are tracked in [CHANGELOG.md](CHANGELOG.md).
+Issues and PRs welcome, field reports on real event volumes per setting
+especially. See
+[CONTRIBUTING.md](https://github.com/spydisec/WinLogKit/blob/main/CONTRIBUTING.md)
+for how changes land,
+[SECURITY.md](https://github.com/spydisec/WinLogKit/blob/main/SECURITY.md)
+for reporting vulnerabilities, and
+[CHANGELOG.md](https://github.com/spydisec/WinLogKit/blob/main/CHANGELOG.md)
+for what changed. Planned work is tracked in
+[issues](https://github.com/spydisec/WinLogKit/issues).
 
 ## License
 
-[MIT](LICENSE). The upstream Yamato Security projects are also MIT licensed.
+[MIT](https://github.com/spydisec/WinLogKit/blob/main/LICENSE). Not
+affiliated with or endorsed by Yamato Security, the ASD or Microsoft; the
+Yamato projects the settings derive from are also MIT licensed, and the
+kit's deliberate deviations from them are
+[documented with reasons](https://spydisec.github.io/WinLogKit/baselines/#deviations-from-the-yamato-sources).