Extended Logons?

ewilli11

Has anyone figured out a way to filter for extended logons?

jeremymayfield

Yes, SEM makes it straightforward to filter for specific logon types often called "extended logons" in this context. Windows Security events especially 4624/4625/4634 include a LogonType field that indicates the kind of logon:

• 2 = Interactive (local console logon)
• 3 = Network (most common background/system logons, e.g., file shares, WMI polling)
• 7 = Unlock
• 10 = Remote Interactive (RDP)
• And others (Batch=4, Service=5, etc.)

SEM normalizes these Windows events, so the LogonType field which is sometimes shown as a number or friendly description like "Network" or "Remote Interactive Logon" is available for filtering.

SEM already ships with several useful Authentication category filters that handle logon types behind the scenes:

• User Logons: Shows all types of user logons.
• Interactive User Logons: Focuses on real user interactive sessions (filters out most background network noise).
• Remote User Logons: Specifically for remote/RDP-style logons.
• Failed Logons: For wrong-password attempts.

These are available in the Live Events view or Filters pane. You can enable/disable or clone them.

If you want to create a custom filter for the logon types:

1. Go to Live Events or the Events console in the SEM web console.
2. In the Filters pane left side, click to create a New Filter or edit an existing one like Interactive User Logons.
3. In the filter builder:
   • Drag fields from the left looking under Events or normalized fields.
   • Add conditions such as:
     • EventType = UserLogon (or Logon / Authentication)
     • LogonTypeequals2 (for interactive only)
     • Or LogonTypeis not equal to3 (to exclude noisy network logons)
     • You can combine with UserName, SourceMachine, DestinationMachine, time ranges, etc.
   • Use operators like equals, contains, not equals, or wildcards ** for "contains" in some older views.
4. Save the filter and don't forget to turn it on.