Windows Event IDs logging

Answered

Nicholas Welch

• October 09, 2017 16:35

I've gone through the threat manager and log manger, and have not found a specific way to set up for a certain Event ID. Is there something I am missing, or is this a feature that is not available to set up? 

Yes 0 No

• Official comment

  

  Abby Kincer

  • July 17, 2020 19:47
  • Edited

  Hi Nick, thanks for reaching out! You can set up a correlation alert based on the message type that is associated with the Windows Event ID in question.

  For example, the message type "Windows Failed Logins" has a Windows Event ID of 4625. You can create an alert based on the "Windows Failed Login" message type, not Windows Event ID #4625.

  I'm also attaching a document that gives you step-by-step instructions for creating a correlation alert that I hope helps: Create and Apply Collection Alert Rules

  Let us know if you have further trouble or questions.
• 

  Abby Kincer

  • October 26, 2017 16:05
  • Edited

  Nick - I wanted to follow up with you on another potential solution for this!

  You can use a correlation policy with an alert trigger for a specific Windows Event ID. If you don't know the message type that corresponds to a particular Windows Event ID, search your messages for the Event ID and make note of the message type. An example of this in the Alert Logic console is below:

  

  I'm also including an example of how a correlation policy will be configured using this method. In the Alert Logic console, click Log Manager > Policies > Correlation > orange plus sign and then fill out the Add Correlation form similar to below:

  

  Let us know if you have further questions - we'd be happy to help.

  Yes 0 No

Please sign in to leave a comment.