Security Compliance

Create a rule or alert for failed Windows update events

Monitor failed Windows update events in SEM.

First published date

10/30/2018 6:21 PM

Last published date

10/30/2018 6:21 PM

Overview

This article describes how to create an alert or rule for failed Windows update events in Security Event Manager (formerly Log & Event Manager).

Product section

Security Event Manager

Resolution

You can use the Clone option and enable the feature in SEM to enable the Windows Update Failure rule to track failed Windows update events. The default action for this rule is to generate a HostIncident event, which can be modified to send an email alert by using the Send Email Message under the Actions pane on the left.

  1. Log on to SEM using an administrator account.
  2. On the SEM menu bar, navigate to Build > Rules.
  3. In the Refine Results search box, enter Windows Update Failure.
  4. Under Rule Templates, click the gear icon next to the rule, and then select Clone.
  5. In the Rule Creation window, select the Enable check box, and then click Save.
  6. On the main Rules screen, click Activate Rules. 

Note: Make sure that the SEM Windows agent is installed on the machine where you are monitoring failed Windows Update events.