Event Definitions Setup Help

[gsmith]

Hey @monarch684

Thanks for the added info, What I did was the following for my Active directory.

Example:

This will show up Under alerts.

EDIT:
I also found this for ya, hopeit helps.

Events and custom fields

Hi, I am fairly new to Graylog, having done a Graylog 4.1.3 installation from scratch on Debian 10, Elasticsearch 7.10. So far, a lot of things are running smoothly, but I have problems understanding the concept of custom fields in alerts/events. Exact usecase: I have an aggregation event that collects Windows Event ID 4625 (failed logon) over 5 minutes. If there are more than 4 events for the same User (Aggregation → Group by field(s) → “TargetUserName”) , the event is triggered. This works …