# Explore and Analyze Logpoint Agent Events

After Logpoint ingests Windows logs:

* Use **Search** to access and examine events.
* Create custom **Dashboards** for real-time visibility.
* Generate **Reports** for compliance and trend analysis.
* Configure **Alerts** to detect suspicious activity.

#### Search

Use the following queries to explore common Logpoint Agent events:

| Scenario                    | Search Query                                                                                                                    |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| All Logpoint Agent logs     | `col_type = "LPAgent"`                                                                                                          |
| Windows Event Logs          | `col_type = "LPAgent" module_type = "event_log"`                                                                                |
| Security Event Logs         | `col_type = "LPAgent" module_type = "event_log" log_name = "Security"`                                                          |
| Failed logon attempts       | `col_type = "LPAgent" module_type = "event_log" event_id = 4625`                                                                |
| Successful logon events     | `col_type = "LPAgent" module_type = "event_log" event_id = 4624`                                                                |
| Account lockouts            | `col_type = "LPAgent" module_type = "event_log" event_id = 4740`                                                                |
| PowerShell execution        | `col_type = "LPAgent" module_type = "event_log" log_name IN ["Microsoft-Windows-PowerShell/Operational", "Windows PowerShell"]` |
| File collection logs        | `col_type = "LPAgent" module_type = "file_collection"`                                                                          |
| File integrity events       | `col_type = "LPAgent" module_type = "file_scanner"`                                                                             |
| New files created           | `col_type = "LPAgent" module_type = "file_scanner" action = "FILE_CREATE"`                                                      |
| Files modified              | `col_type = "LPAgent" module_type = "file_scanner" action = "FILE_MODIFY"`                                                      |
| Files deleted               | `col_type = "LPAgent" module_type = "file_scanner" action = "FILE_DELETE"`                                                      |
| Registry changes            | `col_type = "LPAgent" module_type = "registry_scanner"`                                                                         |
| Registry modifications      | `col_type = "LPAgent" module_type = "registry_scanner" action = "REGISTRY_MODIFY"`                                              |
| Registry deletions          | `col_type = "LPAgent" module_type = "registry_scanner" action = "REGISTRY_DELETE"`                                              |
| Critical Windows events     | `col_type = "LPAgent" module_type = "event_log" level IN ["Critical", "Error"]`                                                 |
| Events from specific device | `col_type = "LPAgent" source_address = "192.168.1.100"`                                                                         |
| Service start/stop events   | `col_type = "LPAgent" module_type = "event_log" event_id IN [7035, 7036, 7040]`                                                 |
| Process creation events     | `col_type = "LPAgent" module_type = "event_log" event_id = 4688`                                                                |
