# Windows Event Log - Security

**URL:** <https://community.graylog.org/t/windows-event-log-security/10811>\
**Category:** Graylog Central (peer support)\
**Created:** [June 17, 2019, 1:48pm UTC](https://community.graylog.org/t/windows-event-log-security/10811 "2019-06-17T13:48:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![tekcap](https://avatars.discourse-cdn.com/v4/letter/t/ee7513/32.png) [@tekcap](https://community.graylog.org/u/tekcap)\
**Post date:** [June 17, 2019, 1:48pm UTC](https://community.graylog.org/t/windows-event-log-security/10811/1 "2019-06-17T13:48:00Z")

</div>

Hello,

Recently installed Graylog on CentOS 7 following this guide : [https://www.itzgeek.com/how-tos/linux/centos-how-tos/how-to-install-graylog-on-centos-7-rhel-7.html](https://www.itzgeek.com/how-tos/linux/centos-how-tos/how-to-install-graylog-on-centos-7-rhel-7.html)

I configured Windows Server 2016 with the following NXlog config:

```
<Extension _gelf>
Module xm_gelf
</Extension>

<Input eventlog>
    # Use 'im_mseventlog' for Windows XP, 2000 and 2003
    Module im_msvistalog
    # Uncomment the following to collect specific event logs only
    Query <QueryList>\
               <Query Id="0">\
                   <Select Path="Application">*</Select>\
                   <Select Path="System">*</Select>\
                   <Select Path="Security">*</Select>\
               </Query>\
           </QueryList>
</Input>

<Output out_udp>
    Module om_udp
    Host 192.168.1.6
    Port 12201
    OutputType GELF_UDP
</Output>

<Route eventlog_to_udp>
    Path eventlog => out_udp
</Route>

```

Now everything works, and I get my event-id 4740 for password lockouts, which I push to a stream and then get alerts for that stream.  
My question: Is there some built in feature for Graylog that can analyze my Event-ids and alert me for strange behavior, or do I have to browse the Internet finding all the event ID’s that I should be alerting on?

---

<div class="post-metadata">

**Author:** ![Karlis](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/karlis/32/4798_2.png) [@Karlis](https://community.graylog.org/u/Karlis)\
**Post date:** [June 17, 2019, 3:03pm UTC](https://community.graylog.org/t/windows-event-log-security/10811/2 "2019-06-17T15:03:46Z")

</div>

I am using this:

# [Active Directory Auditing (NXLOG)](https://marketplace.graylog.org/addons/750b88ea-67f7-47b1-9a6c-cbbc828d9e25)

---

<div class="post-metadata">

**Author:** ![tekcap](https://avatars.discourse-cdn.com/v4/letter/t/ee7513/32.png) [@tekcap](https://community.graylog.org/u/tekcap)\
**Post date:** [June 17, 2019, 3:24pm UTC](https://community.graylog.org/t/windows-event-log-security/10811/3 "2019-06-17T15:24:36Z")

</div>

Cool! I see there is a new version, I’ll grab that and see if I can get it working

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [July 1, 2019, 3:24pm UTC](https://community.graylog.org/t/windows-event-log-security/10811/4 "2019-07-01T15:24:38Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.