Security Compliance

SEM: Configuring Windows Event Logs connectors to function correctly

In order for the Windows Event Log connectors to function correctly on a Windows node, additional configuration is required.

First published date

7/15/2022 6:58 PM

Last published date

7/7/2025 3:08 PM

Overview

This article provides a step-by-step procedure enabling the Windows Event Log connectors to function correctly on a Windows node for SEM.

Product section

Security Event Manager

Resolution

  1. Add value to the registry key

    1. Open the Windows Registry Editor (regedit.msc)

    2. Go to Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog.

    3. Create a new key using the value copied from Full Name in step 1e.
      Capture4.PNG

    4. Close the Registry Editor and Event Viewer.

  2. Find the Windows Event Log in Event Viewer on the node to be configured.

    1. Open the Windows Event Viewer.

    2. Locate the required Event Log path, e.g for Windows Defender Operational Event Log the path would be Application And Services Logs\Microsoft\Windows\Windows Defender\Operational.

    3. Right-Click on the Event Log and select Properties.
      Capture2.PNG

    4. Make sure Enable Logging option is checked.

    5. Copy the Full Name value. In this example, this is Microsoft-Windows-Windows Defender/Operational.

  3. Check to ensure log entries are working on Windows via PowerShell

    1. Open PowerShell and run the command: Get-EventLog -List
      Capture3.PNG

    2. Find your new Event Log in the Log column and check the number of entries. If this shows any number (including 0), you can proceed to step 4.
      If there is no number (not even 0) under the Entries column and the command Get-EventLog -LogName 'Microsoft-Windows-Windows Defender/Operational' returns an invalid handle error, restart the machine on which the agent is running, and try the  Get-EventLog -List command again. 

  4. From the main SEM menu, go to Configure > Nodes > Select Node > Manage Node Connectors
  5. Add a specific connector to the agent.
    add-connector.png
  6. Make sure the Log File matches the Full Name from Step 1e.
  7. Start the connector and receive logs.

    New Incoming logs for specific connectors should now be visible.image-20220523-120021.png