WinEventLog for monitoring BitLocker

Question

I am a Newbie to Splunk and working on monitoring the BitLocker process. I wondered if I could leverage any Windows Security logs to check whether the BitLocker was enabled by someone to encrypt files or disks. Also, I wanted to monitor if anyone deleted the BitLocker Recovery key on ActiveDirectory.

Answer 1

Start with the MSDN article on BitLocker

Then go to

• Server logs
• Client logs

What do you want to collect? Why? How do you intend to use them?