Hi,

I'm trying to monitor critical events in the Windows event log for my ADFS servers. These events are in the log "AD FS\Admin". When I configure the sensor, I can choose Applications, Security, Systems and others. The log I'm looking for is not listed... Is there a built-in way to monitor my ADFS\Admin log?

The physical path of the log: %SystemRoot%\System32\Winevt\Logs\AD FS%4Admin.evtx

Article Comments

Hello,

Thank you for your message.

Regarding what you would like to achieve, I invite you to have a look at this How-To article which will help you to add the log file you desire to monitor to the WMI class used by the sensor.

Afterwards, create the sensor anew and check that the event log is well recognized by the meta scan.

If you have questions, let us know.

Regards.


Aug, 2021 - Permalink

Thank you it works!


Sep, 2021 - Permalink

Thank you very much for your feedback. Glad to hear that it works.

Have a nice day.


Sep, 2021 - Permalink