Event log alerts can often by cryptic and difficult to understand, especially when alerts need to be interpreted by non-technical staff. EventSentry makes it easy to simplify complex alerts by letting you completely re-write the content.
For example, the following potentially complex event log message, event 4688:
A new process has been created.
Security ID: DOMAINX\john.doe
Account Name: john.doe
Account Domain: DOMAINX
Logon ID: 0x1EBA26
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
New Process ID: 0x1d9c
New Process Name: C:\Program Files (x86)\WinMerge\WinMergeU.exe
Token Elevation Type: TokenElevationTypeLimited (3)
Creator Process ID: 0x1200
Process Command Line: "C:\Program Files (x86)\WinMerge\WinMergeU.exe"
could be simplified in an email alert to read as follows:
User *DOMAINX\john.doe started process C:\Program Files (x86)\WinMerge\WinMergeU.exe on host LAPTOP50
This is possible by utilizing insertion strings (shown in bold) that are utilized in all Microsoft security events and many others. The sentence above can be completely customized, and by reviewing the event definition of event 4688 we can see that insertion strings %1 and %6 are needed to build the custom message. EventSentry uses $STR followed by the number to refer to insertion strings, and $HOSTNAME always refers to the host where the event was logged:
User $STR1 started process $STR6 on host $HOSTNAME
The event message can be customized in the event log filter that is being used to forward an event to an action, and since the customization will almost always apply to a specific event (id), you will need to create a new filter for the event.