---
title: "box.win_nxlog"
canonical: "https://docs.devo.com/space/latest/94664981/box.win_nxlog"
format: markdown
---
> Macro (toc)

## Introduction

These tags are used to identify Windows Event logs that are shipped to Devo using NXLog. We configure NXLog to read the desired Windows Event logs, convert them to JSON format, add a Syslog header, and send them to the Devo. 

> ℹ️ For more information about sending from NXLog in JSON format over syslog, see the [NXLog documentation](https://nxlog.co/documentation/nxlog-user-guide-full#json-over-syslog).

## Tag structure

<span style="color: #172b4d">The full tag must have 3 levels. The first two are fixed as </span>`box.win_nxlog`<span style="color: #172b4d">. The third level identifies the type of events sent and can be assigned dynamically based on event content either in the NXLog configuration file or in a Devo relay rule (if you choose to use the Devo relay).</span>

These are the valid tags and corresponding data tables that will receive the parsers' data:

| **Product / Service** | **Tags** | **Data tables** |
| --- | --- | --- |
| Windows NXLog agent | `box.win_nxlog.adfs` | `box.win_nxlog.adfs` |
| `box.win_nxlog.application` | `box.win_nxlog.application` |
| `box.win_nxlog.dhcp` | `box.win_nxlog.dhcp` |
| `box.win_nxlog.dns` | `box.win_nxlog.dns` |
| `box.win_nxlog.group_policy` | `box.win_nxlog.group_policy` |
| `box.win_nxlog.invalid` | `box.win_nxlog.invalid` |
| `box.win_nxlog.other` | `box.win_nxlog.other` |
| `box.win_nxlog.powershell` | `box.win_nxlog.powershell` |
| `box.win_nxlog.print` | `box.win_nxlog.print` |
| `box.win_nxlog.remote_conn` | `box.win_nxlog.remote_conn` |
| `box.win_nxlog.security` | `box.win_nxlog.security` |
| `box.win_nxlog.smb` | `box.win_nxlog.smb` |
| `box.win_nxlog.sysmon` | `box.win_nxlog.sysmon` |
| `box.win_nxlog.system` | `box.win_nxlog.system` |
| `box.win_nxlog.windows_powershell` | `box.win_nxlog.windows_powershell` |

The parent table called simply** **`box.win_nxlog` will be available and contain all events that were associated with any tag starting with `box.win_nxlog.*`. For more information on how tags work, see the article about [Devo tags](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126204).

## <span style="color: #282828">How is the data sent to Devo?</span>

[NXLog for Windows](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94658530)