Home → Supercharger KB → FAQ: Frequently Asked Questions → Supercharger's Role in WEC
7.2. Supercharger's Role in WEC
What does Supercharger actually do (and doesn't do) in WEC/WEF?
The short answer
Supercharger does not forward or collect your events. The actual forwarding and collection is done entirely by native Windows components, that is Windows Event Forwarding (WEF) on the source machines and Windows Event Collection (WEC) on the collectors. Supercharger is a management, monitoring, and self-healing layer that sits on top of that native machinery. Your events never travel through Supercharger.
Put differently: if you uninstalled Supercharger tomorrow, your events would keep flowing exactly as configured. What you would lose is easy configuration, health visibility, automatic recovery and more, but not the pipeline itself.
Who actually moves the events
WEC/WEF is built into Windows and runs with no third-party software in the data path:
- Forwarders (the source computers) push their events using Windows Remote Management (WinRM), driven by the Target Subscription Manager Group Policy / registry setting.
- Collectors receive those events through the Windows Event Collector service (
Wecsvc) and a WinRM listener, then write them into a destination event log. - Subscriptions (managed natively with
wecutil) define what is collected, and from which computers.
The entire event stream is 100% native Windows: forwarder → WinRM → collector → event log → your SIEM.
What Supercharger actually does
Supercharger's Controller (agent) runs beside WEC on each collector and reports to a central Manager. Its job is everything around the event pipe — not the pipe itself:
- Configures native subscriptions and collector settings through a UI and reusable policy objects (Subscription Policies, Collector Policies, Managed Filters). It writes the same native WEC configuration an administrator would otherwise build by hand with
wecutil. - Monitors the health of the native pipeline. Forwarder Analysis compares WEC's runtime view against Active Directory to show which forwarders are actually reporting and which have gone silent.
- Remediates native failures automatically. Watchdogs restart stalled subscriptions and stalled destination logs; source pruning clears out stale per-source records.
- Scales native collection. Load Balanced Subscriptions distribute forwarders evenly across multiple collectors.
In short: native WEC moves the events; Supercharger makes that native WEC easier to set up, easier to trust, and self-healing.
Why the confusion arises
Because Supercharger is the only thing an administrator looks at as a single pane of glass for the whole deployment, it is easy to assume it is also the transport. It isn't. The UI is a control surface over native plumbing: the agent issues commands and reads status, but the event data travels over WinRM directly between Windows hosts.
Why this distinction matters
- Troubleshooting. A delivery problem, where events are not arriving, is almost always a native WEC / WinRM / permissions issue, not a Supercharger issue. Supercharger will help you find the problem, but the fix usually lives in Group Policy, WinRM configuration, or the Security Log permissions on the forwarders.
- Failure domains. If the Supercharger Manager is down, event collection continues uninterrupted. You temporarily lose management and monitoring, but not the events.