| Setting | Sends events to | Read it with |
|---|---|---|
AuditFolder | A share, one JSON line per event, a file per day, a subfolder per person and computer | Splunk universal forwarder, or Sentinel’s Azure Monitor Agent |
AuditSplunkUrl and AuditSplunkToken | A Splunk HTTP Event Collector | Splunk, sourcetype wnd:terminal:audit |
AuditSyslog | A syslog collector, as CEF over syslog (RFC 5424) | Microsoft Sentinel’s CEF connector, QRadar, ArcSight |
Every event also goes to the computer’s own log, audit/audit-YYYY-MM-DD.jsonl in the app’s data folder. That folder is %APPDATA%\com.wndsoftware.terminal on Windows and ~/Library/Application Support/com.wndsoftware.terminal on a Mac. In Group Policy, all three destinations are in one setting, Audit log destinations.
The audit folder
Each copy of WND Terminal writes to its own subfolder of AuditFolder, one per person and computer. Inside, there is one file per day, such as audit-2026-10-08.jsonl, with one JSON line per event. Point your collector at the whole share.
What’s recorded
- WND Terminal started, and which policy it used.
- Connections, with who, which computer, host and port, encrypted or not, the certificate’s fingerprint, the terminal name and whether a backup address was used.
- Connections blocked by policy, and certificates people chose to trust.
- Sign-in with a certificate, recorded as
signed_in_with. - Copies (how many rows and characters), pastes and prints.
- File transfers, with file names, direction, bytes and outcome.
- Print jobs received from the mainframe.
- Screens sent to the AI, with where they went and how many values were masked.
Each event says who, which computer, when and the outcome. Anything the policy refused is recorded as “refused”. Other features, such as Ask WND, Fill from Excel, help-desk tickets, session recordings and readiness reports, add their own events without content.
What’s never recorded
The audit log never holds screen contents or keystrokes. The Splunk token isn’t shown in the app or written to its logs.
Splunk
You can send events to Splunk in two ways. Set AuditSplunkUrl to your HTTP Event Collector, such as https://splunk.example.com:8088/services/collector/event, and AuditSplunkToken to its token. Events arrive with sourcetype wnd:terminal:audit. While the collector can’t be reached, events wait and are sent later.
Or set AuditFolder to a share and point Splunk’s universal forwarder at it with sourcetype = _json.
Microsoft Sentinel
Set AuditSyslog to the syslog collector behind Sentinel’s CEF connector, such as udp://siem.example.com:514 or tcp://siem.example.com:514. Or point Sentinel’s Azure Monitor Agent at AuditFolder as a custom JSON log.
QRadar and ArcSight
Both read the CEF events from AuditSyslog. The CEF fields are below.
| CEF field | Value |
|---|---|
| Vendor | WND Software |
| Product | WND Terminal |
| Signature | The event kind, such as transfer.end |
suser, shost | The person and their computer |
dhost, dpt | The mainframe host and port |
outcome | The result, such as refused |
fname, fsize | File name and size, for file transfers |
Set the destinations
Use Group Policy (Audit log destinations), Intune, a Mac configuration profile or policy.json. In policy.json it looks like this.
{
"AuditFolder": "\\\\fileserver\\WNDAudit$",
"AuditSplunkUrl": "https://splunk.example.com:8088/services/collector/event",
"AuditSplunkToken": "your-hec-token",
"AuditSyslog": "tcp://siem.example.com:514"
}Set only the ones you use. RecordAudit = false turns the audit log off entirely. See the policy settings reference and the security overview.