# Windows event security log

**URL:** <https://community.graylog.org/t/windows-event-security-log/8195>\
**Category:** Graylog Central (peer support)\
**Created:** [December 27, 2018, 4:06pm UTC](https://community.graylog.org/t/windows-event-security-log/8195 "2018-12-27T16:06:11Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Forward](https://avatars.discourse-cdn.com/v4/letter/f/91b2a8/32.png) [@Forward](https://community.graylog.org/u/Forward)\
**Post date:** [December 27, 2018, 4:06pm UTC](https://community.graylog.org/t/windows-event-security-log/8195/1 "2018-12-27T16:06:11Z")

</div>

Hi Guys,

I have succesfully configured graylog with windows server using nxlog, but I would like to send only securty event concern a specific user.

What are the parameters that I can use?

Here you a part of nxlog.conf file

 Module im\_msvistalog

```
Query <QueryList>\
        		<Query Id="0">\
        		<Select Path="Security">*[System[(EventID=4625)]]</Select>\
			<Select Path="Security">*[System[(EventID=4624)]]</Select>\
		<Select Path="Security">*[System[(EventID=4634)]]</Select>\
		</Query>\
       	</QueryList>

```

Thanks in advange  
Bye  
Paolo

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [January 10, 2019, 4:06pm UTC](https://community.graylog.org/t/windows-event-security-log/8195/2 "2019-01-10T16:06:16Z")

</div>

Closed on January 10, 2019, 4:06pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.