Ingesting specific Windows event source

[mbabinski (Micah Babinski)]

Here are some previous threads that might help:

Filter Event Windows

Hello, I am using a collector that will look for Windows events, except it takes all of them and I would like to be able to specify only events 4771 and 4768. In order to solve this problem I tried another method, using an agent that I placed on my windows machine. Unfortunately, InsightIDR does find the agent, but I don’t see the data. Would you know how to get to InsightIDR only the events you want with the collector?

Collect Event ID 307 using Insight Agent

Is it possible to use the Insight Agent to send Microsoft-Windows-PrintService/Operational logs (C:\Windows\System32\winevt\Logs\Microsoft-Windows-PrintService%4Operational.evtx)? I’ve looked through the documentation on using the logging.json file and seems that the file will only send all Application, System and Security events to the platform, or if using the tailing function, that will only work on UTF-8 text files (not evtx files). Would forwarding logs to a WEF server and then use that WE…

Good luck!