Filters for Specific Use Cases. Please advise!

RDP traffic information (Remote user logon and logoff) - There is an out of the box filter called 'Remote User Logons'. It is based on UserLogon.LogonType=*Remote*

Workstation Logon/Logoff - Windows does not generate a specific Event ID for workstation authentication. You would need to create a user defined group which contains all your workstations. You can then create a filter for UserLogon.SourceMachine = Workstations (your user defined group).

Administrative Use - You can create a filter to show all administrative logon, UserLogon.SourceAccount=*admin* (or integrate to your Domain Admins group in AD to capture authentication from any user within that group).

Users accessing drives/folders/files: LEM's File Integrity Monitoring may assist with this use case. There is an out of the box filter called 'All File Audit Activity'. You can adjust this filter to capture specific file types, file names, usernames, etc.

Thank you very much.

About RDP logging,  how can when a user logs off or disconnects from the remote computer?

I tried UserLogoff.LogonType = *Remote*, but that did not work.

Thank you very much!

*I couldnt edit the previous reply*

I also want to know if there are documentations I can read to learn about all the events and event groups in Filter Creation.

Could you send me a screenshot of your filter conditions?

UserLogoff.LogonType = *remote* should work:

Thank you for your time.

I got it working. It was me. I disconnected the remote session instead of signing out = logging off. Therefore, the events did not report into LEM.