circle-info
Welcome to the new Logpoint documentation portal! Can’t find what you’re looking for?
Logpoint Documentationarrow-up-right
search

Access Windows logs

Query AgentX logs from Windows endpoints in Logpoint.

hashtag
Prerequisites

  • AgentX collecting logs from Windows endpoints

  • Logs normalized using AgentXWindowsCompiledNormalizer

  • Access to Logpoint search interface

hashtag
Windows logs

To access all collected Windows logs:

"col_type"="LPAgentX" "agentx_agent_os"="windows"

hashtag
Windows generic logs

To access generic Windows logs (third-party applications, web servers, DNS, DHCP, etc.):

"col_type"="LPAgentX" "norm_id"="WinServer"

hashtag
Windows Event Channel logs

To access Windows Event Channel logs (system, security, application, etc.):

"col_type"="LPAgentX" "location"="EventChannel"

To filter by specific channel:

"col_type"="LPAgentX" "location"="EventChannel" "system_channel"="Security"

Common channels: Security, System, Application, PowerShell

hashtag
Windows Sysmon logs

To access Windows Sysmon logs:

To filter by Sysmon event type:

Common Sysmon Event IDs:

  • 1 - Process creation

  • 3 - Network connection

  • 7 - Image loaded (DLL)

  • 8 - CreateRemoteThread

  • 11 - File created

hashtag
Windows Security Auditing logs

To access Windows Security Auditing logs:

To filter by specific Event ID:

Common Security Event IDs:

  • 4624 - Successful logon

  • 4625 - Failed logon

  • 4688 - Process creation

  • 4720 - User account created

  • 4732 - User added to security group

hashtag
Windows Security Configuration Assessment logs

To access Security Configuration Assessment logs:

To filter by assessment result:

hashtag
Windows OSQuery logs

To access OSQuery logs:

hashtag
Windows Active Response logs

To access Active Response logs (automated remediation actions):

hashtag
Windows File Integrity Management logs

To access File Integrity Management logs:

To filter by action type:

Actions: added, modified, deleted

hashtag
Windows DNS Server logs

To access Windows DNS Server logs:

hashtag
Windows IIS logs

To access Windows IIS logs:

hashtag
Windows DHCP logs

To access Windows DHCP logs:

hashtag
Windows MSSQL logs

To access Microsoft SQL Server logs:

hashtag
Filter by specific endpoint

To view logs from a specific Windows endpoint:

Replace <hostname> with the endpoint hostname.

hashtag
Next steps

Last updated

Was this helpful?