You can configure EventSentry to ignore specific services to prevent unnecessary alerts. Please note that excluding a service via the System Health settings will also prevent that service from being tracked in the Web Reports. If you still wish to see the service status in your reports but simply want to suppress the alerts it is preferable to ...
A small number of EventSentry tasks can be automated with the EventSentry PowerShell module that can be downloaded from our github herehttps://github.com/eventsentry/powershellmodule. The module is under development and new versions with additional functionality will be posted here. Suggestions for new functionality are welcome. Prerequi...
What is AppLocker Introduced in Windows 7 Enterprise Edition AppLocker provides a mechanism within Windows to whitelist / blacklist known applications publishers or file hashes via Group Policy. AppLocker provides Administrators the ability to restrict the execution of these resources in Enforce rules mode or to generate audit logs in...
EventSentry can send alerts to Microsoft Teams by using an HTTP action to integrate with an incoming webhook. First you will need to configure a webhook in the Teams channel that you want to send event log alerts to. You can follow this article from Microsoft to create an incoming webhookhttps://support.microsoft.com/enus/office/createinco...
NOTE: Starting in EventSentry 5.1 the default way to purge your database is from Web Reports. Please see KB 523https://www.eventsentry.com/kb/523 for information on how to set up this new purge and change the number of days in your retention period. When EventSentry is installed there is an option in the Configuration Assistant to...
Please ensure that you do not have Registry Auditing enabled for the following registry path: HKEYLOCALMACHINE\SOFTWARE\netikus.net\EventSentry\bootscan HKEYLOCALMACHINE\SOFTWARE\Wow6432node\netikus.net\EventSentry\bootscan Usually registry auditing becomes enabled for this path due to auditing the EventSentry registry path or auditing the ...
Open the management console Navigate to Packages System Health In the ribbon click on the arrow below Filter and select Disk Space Locate the appropriate package Disk Space Error or Disk Space Warning depending on the severity of the alert expand it and click on Disk Space Adjust the alert thresholds under Limits Save the co...
Yes you can monitor several aspects of Subversion with EventSentry. We will assume that SVN is installed in C:\CSVN and that the repositories are installed in C:\SVN. Services CollabNet Subversion Edge csvnconsole CollabNet Subversion Server collabnetsubversionserver Disk Space Using folder monitoring System Health Disk ...
This HowTo illustrates how to configure EventSentry to support multiple tenants customers utilizing a single installation with multiple databases: Single EventSentry installation One database per customer for isolation One EventSentry Web Reports installation with one profile per customer In this scenario computers from di...
In EventSentry Variables allow you to dynamically assign values to groups or hosts. This allows you to create more flexible configurations when objects such as actions share most but not all configuration values. A good example of a use case for variables is in your email action. For example if you have two groups of servers and want diffe...
The National Security Agency NSA and the Central Security Service CSS published the document Spotting the Adversary with Windows Event Log Monitoring which in section 4 lists a number of events which are recommended to be collected by a log / SIEM monitoring solution. We have made a downloadable EventSentry package file available for do...
EventSentry monitors all scheduled tasks on a system by default and will generate an alert when a scheduled task is added removed or changed. Open the management console Navigate to Packages System Health In the ribbon click on the arrow below Filter and select Scheduled Tasks Locate the appropriate package expand it and click on ...
File monitoring aka as File Integrity Monitoring FIM monitors directories to detect changes to files as well as files being added and removed from directories. By default EventSentry monitors all files with the .exe and .sys extension in the SYSTEMROOT\system32 as well as SYSTEMROOT\syswow64 directories on x64 systems to ensure that c...
Yes to get notified when an IIS site is stopped or started follow the steps below: In the Windows event viewer navigate to the MicrosoftWindowsIISConfigurationOperational event log Rightclick the log and select Enable Log In EventSentry create a new include filter which looks for the following event properties: Custom e...
Open the management console Navigate to Packages System Health In the ribbon click on the arrow below Filter and select Network Time Sync Locate the appropriate package expand it and click on Network Time Sync NTP Adjust the interval tolerance event severity and/or NTP server list Save the configuration To add NTP monitoring...
Open the management console Navigate to Packages System Health In the ribbon click on the arrow below Filter and select Disk Space Locate the appropriate package e.g. Database Purge for alerts regarding the PostgreSQL database size expand it and click on Disk Space Click the Directory Monitoring tab Locate the correct direct...
Yes. The preferred method for managing agent configurations is through the collector which can automatically deploy the EventSentry configuration as well as agent updates. See EventSentry Collector below for more details. If you are not using the collector then follow the instructions below. Creating a group and configuring local permission...
Filters are processed sequentially onebyone by the EventSentry agent. If an event matches multiple filters then every filter matching the event will send the event information to the configured target. This usually happens when more than one filter is configured to use Trigger all actions. To avoid seeing events multiple times: Config...
Forwarding Syslog messages as email alerts is a threestep process assuming that Syslog messages are already successfully received in EventSentry: Enable Syslog to Event Log which creates events in the application event log from the Syslog messages Configure one or more Syslog text filters Create filter rule to forward those events to a...
Synology diskstations offer a SNMP counter that can be monitored with EventSentry to alert if a system update is available. This information can be obtained by monitoring the upgradeAvailable SNMP OID 1.3.6.1.4.1.6574.1.5.4.0 This counter returns one of the following values: 1: Available 2: Unavailable 3: Connecting 4: Disconnect...
If you are getting diskspace alerts about a specific drive that is expected to have little or no disk space available such as the destination for a backup then you can create a customized rule to disable alerts on that particular drive. Open the management console Expand Packages and click System Health Click Add on the ribbon to add a new ...
Event log alerts can often by cryptic and difficult to understand especially when alerts need to be interpreted by nontechnical staff. EventSentry makes it easy to simplify complex alerts by letting you completely rewrite the content. For example the following potentially complex event log message event 4688https://system32.eventsentry....
In order to transfer the EventSentry configuration from a remote computer to the computer running the management application do the following: 1 Log in on one of the remote computers running the agent 2 Open up the registry editor regedit.exe and select the HKEYLOCALMACHINE\Software\netikus.net\EventSentry subkey 3 From the File or Regi...
When packages that are assigned to individual computers do not work then please make sure that the computers in question are part of an AD domain. If the computers are not and/or cannot be part of an AD domain then you will have to manage the computers using their NetBIOS names. Otherwise EventSentry will not correctly identify the computer ...
Yes using the Regular Expression match type of an EventSentry event log filter you can get notified when a credit card number appears in an event log message or log file. Credit Card numbers should never be stored in clear text in any type of log file whether in a production or test environment. If you monitor your event logs and/or log files...