Windows Events Reports

To search for and generate a report on data on all Windows Event IDs, the number of events for each ID, and a description of each ID for selected log sources running the Microsoft Windows operating systems, use the Windows Events Real-Time Report.

For example, the captured log events include application, security, and system events.

Menu path: Reports > Access Control > Windows Events

In addition to setting the common report options in Preparing a Real-time Report, you can select optional filter operators in the generated report.

Optional filter operators can be sorted in ascending or descending order. Choose sort order using the drop-down menu. The default is to display only the Source Device, Event ID, and Count.

For information on saving the generated report, see Formats for Saving a Generated Report.

Windows Events Report - Optional Filter Operators
Option Description
Source Device Description of the device that sent these log messages
Event ID Numeric ID corresponding to the source device
User User ID on the source device
Source Domain Domain name of the source device
Target User User ID of the destination device
Target Domain Domain name of the destination device
Originating Host The original host name where the event was originally created
Subsystem The subsystem of the host
Originating IP The original source IP address where the event was originally created
Event Name Name of the event
Application Type The type of application that generated the event
Action Action taken
Status Status of use
Type Content type of the object as seen in the HTTP reply header
Count Number of Windows events for the source device