EventLog Analyzer comes packaged with over 1,000 predefined reports that help organizations view consolidated security events, conduct security audits, and meet various compliance requirements. These reports help organizations visualize security events in their network and meet various security and compliance requirements.
In this help document, you will learn to set up Windows report generation.
Setting up Windows report generation
In EventLog Analyzer, most Windows reports get generated automatically when the device is added for monitoring and the event source is configured. To learn how to add a device, check out this page. To learn how to configure an event source, check out the How to configure event source files in a device? section in this page.
There are certain reports, mentioned in the table below, that will require manual creation of keys in your Windows Registry. To set up the generation of these reports, follow the steps given below.
Please make sure event logging has been enabled by right clicking on the event source > Properties > checking the Enable logging box, in Event Viewer.
Open the Registry Editor and navigate to HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Service > EventLog. Here, create the keys given in the New keys column of table below.
Next, open Local Group Policy Editor and navigate to Computer Configuration > Windows Setting > Security Setting. Further paths and steps to enable the generation of reports are given in the Audit policies column.
Reports
New keys
Audit policies
Other prerequisites
Application Whitelisting Reports
Microsoft-Windows-AppLocker/EXEandDLL
Microsoft-Windows-AppLocker/MSI and Script
Enable AppLocker under Application Control Policies
Start the service Application Identity.
On creation of the two new keys, a event source Microsoft-Windows-AppLocker/EXEandDLL will be created on the left panel of Event Viewer. Right click on the event source, click Properties, and copy the Log path.
Then navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-AppLocker/EXE and DLL, and create an expandable string value with name File. Use the copied log path from the previous step as Value data.
Configure the Executable rules, Windows Installer rules, and Script rules under the mentioned audit policies.
Restart the machine.
Windows Firewall Auditing Reports
Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
Enable Audit Handle Manipulation, Audit Removable Storage and Audit File System (required for auditing delete operation in NT Version 6.2), under Advanced Audit Policy Configuration > Object Access.
To start logging removable storage events, navigate to Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Storage and add new DWORD registry key named as HotPlugSecureOpen and set value as 1.
Download PDF