cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 7

SEM Monitor Specific Event ID

I'm new to SEM so excuse my noob question. I am wanting to monitor a specific Windows Security Event and have this rule alert only 1 specific system. Firstly I would just like to get this to alert on the event, and then narrow it down. I am interested in the FIle Audit event 4663 in the Windows Security log.

So far I have a Windows Security Connector on the node, and a rule with "FIleAudit.EventInfo is equal to String "An attempt was made*" However I really just want to look out for Event ID 4663 but I cannot see how to do this. 

Thanks in advance

Matt

0 Kudos
1 Reply

Hello,

Event ID is propagated to ProviderSID field, so I guess it should be it what you are looking for. 
 
let us know how that went.
 
Thank you
0 Kudos