Windows Event Log

Windows event logs provide an in-depth record of events related to the system, security, and application stored on a Windows operating system.  Windows event log provides information about hardware and software events occurring on a Windows operating system. For more information about the events refer the Microsoft Event Viewer documentation.

Integration Method:  Data Collector

Tables: File System Activity (1001), Device Config State (5002), Authentication (3002), Datastore Activity (6005), Device Config State Change (5019), Account Change (3001), Entity Management (3004), Network Activity (4001), Application Lifecycle (6002), DHCP Activity (4004), Event Log Activity (1008), Application Error (6008), Process Activity (1007).

Prerequisites

• The user should have a compatible version of the Windows system and configure the data collector.

• The user should have access to the DataBee console.

Configuration Overview

1. Configure the Data Collector

2. Install the Data Collector on your machine and configure filters for the data feed.

   1. Install the Data Collector

   2. Configure Filters

3. Create Windows Event Log Data Feed in the DataBee console.

Data Collector Configuration

In order to receive Windows Event Logs, a Data Collector must be installed and configured. The data collector reads logs from Windows Event Viewer and sends them to DataBee, encrypted. For more information, refer to the Data Collector article.

Note:

The Data Collector needs to be installed where the event viewer logs are accessible.

Windows Configuration

Configure Filters

1. Open Event Viewer App.
    

2. In the Event Viewer app, select a Windows Logs. On the right-hand side, under the ‘Actions’ panel, click on Create Custom View.
    

3. You can choose the relevant filters as needed to refine your results such as Event Level, Event IDs and more.
    

4. Click the XML tab, copy the query for later use, and then click OK.
    

DataBee supports the following event types:

DataBee Configuration

1. Login to the DataBee UI, navigate to Data > Data Feeds and click the Add New Data Feed button.
    

2. Search for Windows Event Log and click it as shown below.
    

3. Click on the Data Collector option for collection method.
    

4. Click on the Windows Events option to poll windows events from windows machine.
    

5. Enter the feed contact information, select the collector that you have created, and click on the Next button.
    

6. Fill the required details to configure the data feed,

   • Refresh Interval (seconds): Select 1 second to achieve optimum performance. The available options are 1, 5, 10, and 20.

   • Channels: Enter the Channel name Security, Application or System from which the Data Collector will retrieve events.

   • Read Historical Event (optional): Enable Read Historical Events to collect all existing events (disabled by default). This may cause duplicate data.

   • Query (optional): To filter data, paste the query for the relevant filter from the earlier step.

   Click on the Next button.
   

7. Click on the Submit button.
    

Troubleshooting Tips 

• If you encounter any issues regarding log forwarding, refer to the DataBee troubleshooting article for detailed guidance.