Security Compliance

Collect AppLocker events in SEM

This article describes how to configure your environment and SEM to read AppLocker event logs.

First published date

10/19/2018 11:10 PM

Last published date

5/30/2019 1:19 PM

Overview

This article covers how to configure your environment and Security Event Manager (formerly Log & Event Manager) to read AppLocker event logs.

Product section

Security Event Manager

Resolution

Modify the AppLocker log file paths on the host machines
 

  1. On the host with the AppLocker log files, open Event Viewer.
  2. Browse to Applications and Services Logs > Microsoft > Windows > AppLocker.
  3. Right-click on the EXE and DLL log file, and then go to Properties.
  4. Remove the spaces in the Log path field, and then click OK.                                                                              
  5. Repeat these steps for the MSI and Script log file.


Add registry keys on the host machines

  1. Go to Start > Run, and then launch regedit.
  2. Browse to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog.
  3. Right-click in the right pane, choose New > Key, and then add each of these keys:
    • Microsoft-Windows-AppLocker/EXEandDLL
    • Microsoft-Windows-AppLocker/MSIandScript

 

Add the AppLocker connectors to the host machines in the SEM Flash console

  1. Open your SEM Console, and then go to Manage > Nodes.
  2. Locate the node for the host you've modified, click on its gear icon, and then go to Connectors.
  3. Search for AppLocker to locate the connectors for MSI and EXE, and MSI and Script.
  4. For each connector, click on the gear icon, click New, and then click Save.
  5. Finally, start each connector by clicking on the gear icons for the new entries, and then selecting Start.
Add the AppLocker connectors to the host machines in the HTML5 SEM Events Console (versions 6.6 and later)
  1. In the SEM Events Console, click the Nodes tab.
  2. Under Refine Results, expand the Type group, and then select the Agent check box.
  3. Select an agent, and then click Manage node connectors. 
  4. In the search box, type AppLocker to locate the connectors for MSI and EXE, and MSI and Script.
  5. Select each connector, and then click Add Connector.
  6. Enter a custom alias name for the new connectors, or accept the default, and then click Add.
  7. Under Configured connectors, select your configured connectors (one at a time), and then click Start.