Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Windows Event ID 4674 monitoring best practices?

Our security team has asked for us to monitor Event ID 4674 on our Windows SCCM server. However, this is causing... quite a few false positives.

Orion isn't showing the event history (probably overwhelmed), but the admin looked and saw that it was our Orion service account that we use for monitoring AppInsight for SQL causing many of these. The events just indicate that the service account is successfully polling the system, but that makes it look like there is an issue with the system.

Is there a better way to do this? I don't know if we can exclude Windows itself from logging events for a given account, or if we can have Orion filter out those events. Honestly, I am also wondering if there's a better way to monitor for security access to the system, but I'm not sure.

Find more posts tagged with

Accepted answers

All comments

wkwittke

You should be able to create a rule in Orion to drop those events.

jm_sysadmin

I agree, in the SAM component you can filter it out in the following sections.

It sounds like you aren't getting false positives, I think you find out about events that were asked for. I think getting more specific on the criteria will help.

That said, SAM is not a great replacement for SIEM tools. Typically those tools will want all the noise because you don't want to miss data that might be needed, then they report or alert based on specific criteria or better yet abnormal behavior.

chucksimalchik

As @jm_sysadmin said, don't try to make SAM do the job of SIEM tools (like SolarWinds SEM). SAM should ideally be used for low volume alertable events. I've run into issues trying to get it to handle/manage/correlate higher volume events and instead use SEM for that purpose.

ahbrook

Thanks all. Admittedly we're not in a position to expand our Solarwinds portfolio (and we're still trying to recover a bit of confidence given recent events). What the security office does most of the time is a mystery to me, so I don't know if they have SIEM tools already.

For now, I'm asking the particular employee why this monitor was set up in the first place (it seems quite unique, having a named template after it) and I'm going to try and filter it.