Create a Windows error events filter in SEM

This article provides steps on how to create a Windows error events filter in Security Event Manager (formerly Log & Event Manager).

Note: Make sure you have already carried out checks that the devices in question are sending Windows error event logs, and that the correct connectors are in place.

In newer versions of SEM, this is an out-of-the-box filter in the HTML5 SEM Events Console and SEM Flash console.

1. On the SEM menu bar, click Monitor.
2. In the Filters pane, click the + sign, and then select New Filter. The template for the new filter appears.
3. Fill out the filter name: Windows error events.
4. Fill out the description: Filter for events from Windows error events logs. 
5. In the Filter Creation window, click Event Groups and locate Any Alert. Other details appear after clicking Any Alert in the list.
6. Under Fields: Any Alert, select EventInfo and drag it into Conditions box. The Any Alert.EventInfo = * appears and you need to type in the word: Error. It should appear as: Any Alert.EventInfo=*Error*
7. Click the small group icon to add another group condition to the condition box. 

   

8. Drag the ToolAlias field to the new conditions box three times and type in the following string conditions:
   • ToolAlias = *NT*
   • ToolAlias = *Vista*
   • ToolAlias = *Windows*
9. The end result should look as follows: 

   

10. Click Save. The new filter appears in the list of filters on the left side of the Monitor page.