[GH-ISSUE #88] Feature Request: Event Log Check, Filter Source and/or Details #47

New issue

Closed

opened 2026-03-02 02:13:07 +03:00 by kerem · 1 comment

kerem commented

2026-03-02 02:13:07 +03:00

Owner

Originally created by @bradhawkins85 on GitHub (Sep 1, 2020).
Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/88

Originally assigned to: @wh1te909 on GitHub.

Would it be possible to update the Event Log check to also take the event source and/or possibly even a string in the details in to consideration when running the check.
Some event id's belong to multiple sources and can trigger false alerts if just checking for a specific event id.

E.G. Event ID 5 belongs to VDS Basic Provider, IsolatedUserMode and Hyper-V-VmSwitch and not all of these need to be alerted when detected.

Originally created by @bradhawkins85 on GitHub (Sep 1, 2020). Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/88 Originally assigned to: @wh1te909 on GitHub. Would it be possible to update the Event Log check to also take the event source and/or possibly even a string in the details in to consideration when running the check. Some event id's belong to multiple sources and can trigger false alerts if just checking for a specific event id. E.G. Event ID 5 belongs to VDS Basic Provider, IsolatedUserMode and Hyper-V-VmSwitch and not all of these need to be alerted when detected.

kerem

2026-03-02 02:13:07 +03:00

closed this issue
added the
enhancement
label

kerem commented

2026-03-02 02:13:08 +03:00

Author

Owner

@wh1te909 commented on GitHub (Sep 1, 2020):

will do! I am making big changes to how checks work on the agent, right now the status of pass/fail is being calculated agent side but instead will be sending the raw data to the RMM and calculate it there, this way have more flexibility in determining status and not having to release a new agent for a new request like this so can implement alot faster.

@wh1te909 commented on GitHub (Sep 1, 2020): will do! I am making big changes to how checks work on the agent, right now the status of pass/fail is being calculated agent side but instead will be sending the raw data to the RMM and calculate it there, this way have more flexibility in determining status and not having to release a new agent for a new request like this so can implement alot faster.

kerem referenced this issue

2026-03-14 01:49:17 +03:00

[GH-ISSUE #47] Feature Request: Variables #1959

kerem referenced this issue

2026-03-14 01:50:44 +03:00

[GH-ISSUE #48] Feature Request: Script Arguments #1960