Forwarding windows log to SIEM tool

Consider using event log forwarding which can be source initiated of the collector (SIEM) initiated. Most of the time an agent will be installed in server such as SNARE or SyslogNG that will then format the log into supported syslog format to the SIEM. The collection is stipulated by your SIEM collector or connector available. You should check out the SIEM support. Specific to RDP log you should be able to go based on event ID. E.g. RDP server related id below would be similar for 2012.

http://www.vkernel.ro/blog/how-to-configure-windows-event-log-forwarding

But I guess you are more interested with RDP connections and specifically logon event of LogType 10; RemoteInteractive; you can check out the forwarding rule in WEF or agent to do filtered forwards otherwise have your SIEM rule to filter out in correlation setup. Best is get specific log rather thw whole lot unless your SIEM is also a log archival system; but it should trivial to add another filter if required at the source based on event ID.

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ff404144(v=ws.10)

Many thanks, siem tool is netwitness from rsa. There is no agent on client but there is however winrm integration guide that's isn't easy to understand.

many thanks