Event Log Forwarding Metrics
Event Log Forwarding
uberAgent can collect Windows system logs from the Eventlog: Application, Security, etc, with advanced filtering capabilities aimed to reduce the data volume processed by the agent.
Details
-
Source type:
uberAgentESA:System:WinEvtLogForwarding -
Used in dashboards: Windows Eventlogs
-
Enabled through configuration setting:
EventLog -
Related configuration settings: Timer
-
Supported platform: Windows
List of Fields in the Raw Agent Data
| Field | Description | Data type | Unit | Example |
|---|---|---|---|---|
| ProviderName | Eventlog provider name | String | Microsoft-Windows-Security-Auditing | |
| EventID | Event ID | Number | 1001 | |
| Level | Event level | Number | 3 | |
| ProcessID | Process ID | Number | 53646 | |
| Channel | Eventlog channel name | String | Security | |
| User | User, under which the process is executing | String | NT AUTHORITY\SYSTEM | |
| EventData | The content of the <EventData>-tag in JSON format | String | {"SubjectUserSid":"S-1-5-18", "SubjectUserName":"SYSTEM", "SubjectDomainName":"NT AUTHORITY", "SubjectLogonId":"0x3e7", "PrivilegeList":"SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege" } |