Access Windows logs
Query AgentX logs from Windows endpoints in Logpoint.
Prerequisites
AgentX collecting logs from Windows endpoints
Logs normalized using AgentXWindowsCompiledNormalizer
Access to Logpoint search interface
Windows logs
To access all collected Windows logs:
"col_type"="LPAgentX" "agentx_agent_os"="windows"Windows generic logs
To access generic Windows logs (third-party applications, web servers, DNS, DHCP, etc.):
"col_type"="LPAgentX" "norm_id"="WinServer"Windows Event Channel logs
To access Windows Event Channel logs (system, security, application, etc.):
"col_type"="LPAgentX" "location"="EventChannel"To filter by specific channel:
"col_type"="LPAgentX" "location"="EventChannel" "system_channel"="Security"Common channels: Security, System, Application, PowerShell
Windows Sysmon logs
To access Windows Sysmon logs:
To filter by Sysmon event type:
Common Sysmon Event IDs:
1 - Process creation
3 - Network connection
7 - Image loaded (DLL)
8 - CreateRemoteThread
11 - File created
Windows Security Auditing logs
To access Windows Security Auditing logs:
To filter by specific Event ID:
Common Security Event IDs:
4624 - Successful logon
4625 - Failed logon
4688 - Process creation
4720 - User account created
4732 - User added to security group
Windows Security Configuration Assessment logs
To access Security Configuration Assessment logs:
To filter by assessment result:
Windows OSQuery logs
To access OSQuery logs:
Windows Active Response logs
To access Active Response logs (automated remediation actions):
Windows File Integrity Management logs
To access File Integrity Management logs:
To filter by action type:
Actions: added, modified, deleted
Windows DNS Server logs
To access Windows DNS Server logs:
Windows IIS logs
To access Windows IIS logs:
Windows DHCP logs
To access Windows DHCP logs:
Windows MSSQL logs
To access Microsoft SQL Server logs:
Filter by specific endpoint
To view logs from a specific Windows endpoint:
Replace <hostname> with the endpoint hostname.
Next steps
Last updated
Was this helpful?