odin13

Thanks! I had to change the query to the following: select alertname, lasterrortime, lasterror from AlertDefinitions where lasterror is Not NULL order by lasterrortime desc

The 'Kill Suspicious Process' works fine indeed... Just make sure the 'Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy\Audit Process Tracking' option is enabled in GPO for the machine(s) you want to activate the rule.