Windows Event IDs logging




  • Official comment
    Abby Kincer

    Hi Nick, thanks for reaching out! You can set up a correlation alert based on the message type that is associated with the Windows Event ID in question.

    For example, the message type "Windows Failed Logins" has a Windows Event ID of 4625. You can create an alert based on the "Windows Failed Login" message type, not Windows Event ID #4625.

    I'm also attaching a document that gives you step-by-step instructions for creating a correlation alert that I hope helps: Create and Apply Collection Alert Rules

    Let us know if you have further trouble or questions.

  • Avatar
    Abby Kincer

    Nick - I wanted to follow up with you on another potential solution for this!

    You can use a correlation policy with an alert trigger for a specific Windows Event ID. If you don't know the message type that corresponds to a particular Windows Event ID, search your messages for the Event ID and make note of the message type. An example of this in the Alert Logic console is below:

    I'm also including an example of how a correlation policy will be configured using this method. In the Alert Logic console, click Log Manager > Policies > Correlation > orange plus sign and then fill out the Add Correlation form similar to below:

    Let us know if you have further questions - we'd be happy to help.


Please sign in to leave a comment.