[GH-ISSUE #996] Feature Request: Event Log Check can only use Application, System and Security #2548

New issue

Closed

opened 2026-03-14 04:30:13 +03:00 by kerem · 2 comments

kerem commented

2026-03-14 04:30:13 +03:00

Owner

Originally created by @JSuenram on GitHub (Feb 28, 2022).
Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/996

Consider you want to monitor Eventlog vor NTLM-Auditing.
You need to look in "Microsoft-Windows-NTLM/Operational" which is not Possible with Event-Log-Check at the moment.

There are about 150 other EventLogs which are not written to Application/System or Security....
Currently you can not use them in TRMM.

Originally created by @JSuenram on GitHub (Feb 28, 2022). Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/996 Consider you want to monitor Eventlog vor NTLM-Auditing. You need to look in "Microsoft-Windows-NTLM/Operational" which is not Possible with Event-Log-Check at the moment. There are about 150 other EventLogs which are not written to Application/System or Security.... Currently you can not use them in TRMM.

kerem closed this issue

2026-03-14 04:30:18 +03:00

kerem commented

2026-03-14 04:30:24 +03:00

Author

Owner

@dinger1986 commented on GitHub (Feb 28, 2022):

you can with powershell, can look at the defender checks for reference

@dinger1986 commented on GitHub (Feb 28, 2022): you can with powershell, can look at the defender checks for reference

kerem commented

2026-03-14 04:30:29 +03:00

Author

Owner

@silversword411 commented on GitHub (Mar 9, 2022):

You can use powershell to query any event log. Use this as example:
https://github.com/amidaware/community-scripts/blob/main/scripts/Win_Defender_Status_Report.ps1

Closing

@silversword411 commented on GitHub (Mar 9, 2022): You can use powershell to query any event log. Use this as example: https://github.com/amidaware/community-scripts/blob/main/scripts/Win_Defender_Status_Report.ps1 Closing