Windows Event IDs logging

Answered

Comments

2 comments

  • Official comment
    Avatar
    Abby Kincer

    Hi Nick, thanks for reaching out! You can set up a correlation alert based on the message type that is associated with the Windows Event ID in question.

    For example, the message type "Windows Failed Logins" has a Windows Event ID of 4625. You can create an alert based on the "Windows Failed Login" message type, not Windows Event ID #4625.

    I'm also attaching an article that gives you step-by-step instructions for creating a correlation alert that I hope helps: https://support.alertlogic.com/hc/en-us/articles/115003572683

    Let us know if you have further trouble or questions.

  • Avatar
    Abby Kincer

    Nick - I wanted to follow up with you on another potential solution for this!

    You can use a correlation policy with an alert trigger for a specific Windows Event ID. If you don't know the message type that corresponds to a particular Windows Event ID, search your messages for the Event ID and make note of the message type. An example of this in the Alert Logic console is below:

    I'm also including an example of how a correlation policy will be configured using this method. In the Alert Logic console, click Log Manager > Policies > Correlation > orange plus sign and then fill out the Add Correlation form similar to below:

    Let us know if you have further questions - we'd be happy to help.

Please sign in to leave a comment.