e1932ff01e
Log name is configurable. MD Docs recommend a log file per profile: https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/configure-logging?tabs=intune
32 lines
467 B
YAML
32 lines
467 B
YAML
##RDP
|
|
source: wineventlog
|
|
event_channel: Security
|
|
event_ids:
|
|
- 4625
|
|
- 4623
|
|
event_level: information
|
|
labels:
|
|
type: eventlog
|
|
---
|
|
##Firewall
|
|
filenames:
|
|
- C:\Windows\System32\LogFiles\Firewall\*.log
|
|
labels:
|
|
type: windows-firewall
|
|
---
|
|
##SQL Server
|
|
source: wineventlog
|
|
event_channel: Application
|
|
event_ids:
|
|
- 18456
|
|
event_level: information
|
|
labels:
|
|
type: eventlog
|
|
---
|
|
##IIS
|
|
use_time_machine: true
|
|
filenames:
|
|
- C:\inetpub\logs\LogFiles\*\*.log
|
|
labels:
|
|
type: iis
|