Microsoft Windows Events

This dashboard displays common statistics from windows events

Microsoft Windows Event Logs ENABLED

Details

ID4cc13d01e2524e9c8113439fd9099058
From Version6.10.0
Supported Modulesxsiam

Screenshot

Microsoft Windows Events screenshot

Widgets (5)

Microsoft Windows Events - Top Actions

This widget displays the common actions

Custom XQL pie 

datamodel dataset in (microsoft_windows_raw)
|filter xdm.observer.type="Microsoft-Windows-*"
|comp count(xdm.event.operation_sub_type) as ActionCount by xdm.event.operation_sub_type
| view graph type = pie subtype = full xaxis = xdm.event.operation_sub_type yaxis = ActionCount

Microsoft Windows Events - Logon Types

This widget displays the common logon types

Custom XQL pie 

datamodel dataset in (microsoft_windows_raw)
|filter xdm.observer.type="Microsoft-Windows-*"
|filter xdm.logon.type!=null
|comp count(xdm.logon.type) by xdm.logon.type
| view graph type = pie subtype = full xaxis = xdm.logon.type yaxis = count_1 valuecolor("NETWORK","#7876b6") valuecolor("INTERACTIVE","#f15050") valuecolor("SERVICE","#b7b797") seriestitle("count_1","Count")

Microsoft Windows Events - Top Proccesses

This widget displays the top proceeses running events

Custom XQL pie 

datamodel dataset in (microsoft_windows_raw)
|filter xdm.observer.type="Microsoft-Windows-*"
|comp count(xdm.source.process.name) as `Count` by xdm.source.process.name
|sort desc `Count`
| view graph type = pie xaxis = xdm.source.process.name yaxis = Count

Microsoft Windows Events - Failed Logins

This widget displays failure logins in a 10 minute period

Custom XQL line 

datamodel dataset in (microsoft_windows_raw)
|filter xdm.event.operation_sub_type="An account failed to log on"
|filter xdm.source.user.username !="-"
|bin _time span = 10M
|comp count(xdm.event.operation_sub_type) as EventCount by _time
| view graph type = line header = "Failed Logins in 10 Minutes" xaxis = _time yaxis = EventCount seriescolor("EventCount","#1e83f7")

Microsoft Windows Events - Top Events

This widget displays the top Event ID's in a descending order

Custom XQL table 

datamodel dataset in (microsoft_windows_raw)
|filter xdm.alert.name !=null
|comp count(xdm.alert.name) as `Event Count` by xdm.alert.name , xdm.event.id 
| fields xdm.alert.name as `Event Name` , xdm.event.id as `Event ID` , `Event Count` 
|sort desc `Event Count`

Source

MicrosoftWindowsEvents_Dashboard.json
Download History Raw 
{
  "dashboards_data": [
    {
      "id": "4cc13d01e2524e9c8113439fd9099058",
      "name": "Microsoft Windows Events",
      "description": "This dashboard displays common statistics from windows events",
      "status": "ENABLED",
      "layout": [
        {
          "id": "row-1237",
          "data": [
            {
              "key": "xql_1677418467521",
              "data": {
                "type": "Custom XQL",
                "width": 33.333333333333336,
                "height": 475.5,
                "phrase": "datamodel dataset in (microsoft_windows_raw)\n|filter xdm.observer.type=\"Microsoft-Windows-*\"\n|comp count(xdm.event.operation_sub_type) as ActionCount by xdm.event.operation_sub_type\n| view graph type = pie subtype = full xaxis = xdm.event.operation_sub_type yaxis = ActionCount ",
                "time_frame": {
                  "relativeTime": 604800000
                },
                "viewOptions": {
                  "type": "pie",
                  "commands": [
                    {
                      "command": {
                        "op": "=",
                        "name": "subtype",
                        "value": "full"
                      }
                    },
                    {
                      "command": {
                        "op": "=",
                        "name": "xaxis",
                        "value": "xdm.event.operation_sub_type"
                      }
                    },
                    {
                      "command": {
                        "op": "=",
                        "name": "yaxis",
                        "value": "ActionCount"
                      }
                    }
                  ]
                }
              }
            },
            {
              "key": "xql_1677409452302",
              "data": {
                "type": "Custom XQL",
                "width": 33.333333333333336,
                "height": 475.5,
                "phrase": "datamodel dataset in (microsoft_windows_raw)\n|filter xdm.observer.type=\"Microsoft-Windows-*\"\n|filter xdm.logon.type!=null\n|comp count(xdm.logon.type) by xdm.logon.type\n| view graph type = pie subtype = full xaxis = xdm.logon.type yaxis = count_1 valuecolor(\"NETWORK\",\"#7876b6\") valuecolor(\"INTERACTIVE\",\"#f15050\") valuecolor(\"SERVICE\",\"#b7b797\") seriestitle(\"count_1\",\"Count\") ",
                "time_frame": {
                  "relativeTime": 2592000000
                },
                "viewOptions": {
                  "type": "pie",
                  "commands": [
                    {
                      "command": {
                        "op": "=",
                        "name": "subtype",
                        "value": "full"
                      }
                    },
                    {
                      "command": {
                        "op": "=",
                        "name": "xaxis",
                        "value": "xdm.logon.type"
                      }
                    },
                    {
                      "command": {
                        "op": "=",
                        "name": "yaxis",
                        "value": "count_1"
                      }
                    },
                    {
                      "func": {
                        "args": [
                          "NETWORK",
                          "#7876b6"
                        ],
                        "name": "valuecolor"
                      }
                    },
                    {
                      "func": {
                        "args": [
                          "INTERACTIVE",
                          "#f15050"
                        ],
                        "name": "valuecolor"
                      }
                    },
                    {
                      "func": {
                        "args": [
                          "SERVICE",
                          "#b7b797"
                        ],
                        "name": "valuecolor"
                      }
                    },
                    {
                      "func": {
                        "args": [
                          "count_1",
                          "Count"
                        ],
                        "name": "seriestitle"
                      }
                    }
                  ]
                }
              }
            },
            {
              "key": "xql_1678005649807",
              "data": {
                "type": "Custom XQL",
                "width": 33.333333333333336,
                "height": 475.5,
                "phrase": "datamodel dataset in (microsoft_windows_raw)\n|filter xdm.observer.type=\"Microsoft-Windows-*\"\n|comp count(xdm.source.process.name) as `Count` by xdm.source.process.name\n|sort desc `Count`\n| view graph type = pie xaxis = xdm.source.process.name yaxis = Count ",
                "time_frame": {
                  "relativeTime": 604800000
                },
                "viewOptions": {
                  "type": "pie",
                  "commands": [
                    {
                      "command": {
                        "op": "=",
                        "name": "xaxis",
                        "value": "xdm.source.process.name"
                      }
                    },
                    {
                      "command": {
                        "op": "=",
                        "name": "yaxis",
                        "value": "Count"
                      }
                    }
                  ]
                },
                "gridRawStorageInfo": {
                  "sort": null,
                  "coldefs": {},
                  "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}",
                  "columnWidth": null
                }
              }
            }
          ]
        },
        {
          "id": "row-5362",
          "data": [
            {
              "key": "xql_1677410396873",
              "data": {
                "type": "Custom XQL",
                "width": 50,
                "height": 475.5,
                "phrase": "datamodel dataset in (microsoft_windows_raw)\n|filter xdm.event.operation_sub_type=\"An account failed to log on\"\n|filter xdm.source.user.username !=\"-\"\n|bin _time span = 10M\n|comp count(xdm.event.operation_sub_type) as EventCount by _time\n| view graph type = line header = \"Failed Logins in 10 Minutes\" xaxis = _time yaxis = EventCount seriescolor(\"EventCount\",\"#1e83f7\") ",
                "time_frame": {
                  "relativeTime": 86400000
                },
                "viewOptions": {
                  "type": "line",
                  "commands": [
                    {
                      "command": {
                        "op": "=",
                        "name": "header",
                        "value": "\"Failed Logins in 10 Minutes\""
                      }
                    },
                    {
                      "command": {
                        "op": "=",
                        "name": "xaxis",
                        "value": "_time"
                      }
                    },
                    {
                      "command": {
                        "op": "=",
                        "name": "yaxis",
                        "value": "EventCount"
                      }
                    },
                    {
                      "func": {
                        "args": [
                          "EventCount",
                          "#1e83f7"
                        ],
                        "name": "seriescolor"
                      }
                    }
                  ]
                }
              }
            },
            {
              "key": "xql_1677409686512",
              "data": {
                "type": "Custom XQL",
                "width": 50,
                "height": 475.5,
                "phrase": "datamodel dataset in (microsoft_windows_raw)\n|filter xdm.alert.name !=null\n|comp count(xdm.alert.name) as `Event Count` by xdm.alert.name , xdm.event.id \n| fields xdm.alert.name as `Event Name` , xdm.event.id as `Event ID` , `Event Count` \n|sort desc `Event Count` ",
                "entityType": "xql-widget-table-5b9b5a9e-8567-4c9d-97df-9a9f412dece6",
                "time_frame": {
                  "relativeTime": 2592000000
                },
                "viewOptions": {
                  "type": "table",
                  "commands": []
                },
                "gridRawStorageInfo": {
                  "sort": null,
                  "coldefs": {},
                  "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}",
                  "columnWidth": null
                }
              }
            }
          ]
        }
      ],
      "default_dashboard_id": 1,
      "global_id": "4cc13d01e2524e9c8113439fd9099058"
    }
  ],
  "widgets_data": [
    {
      "widget_key": "xql_1677409452302",
      "title": "Microsoft Windows Events - Logon Types",
      "creation_time": 1677409452302,
      "description": "This widget displays the common logon types",
      "data": {
        "phrase": "datamodel dataset in (microsoft_windows_raw)\n|filter xdm.observer.type=\"Microsoft-Windows-*\"\n|filter xdm.logon.type!=null\n|comp count(xdm.logon.type) by xdm.logon.type\n| view graph type = pie subtype = full xaxis = xdm.logon.type yaxis = count_1 valuecolor(\"NETWORK\",\"#7876b6\") valuecolor(\"INTERACTIVE\",\"#f15050\") valuecolor(\"SERVICE\",\"#b7b797\") seriestitle(\"count_1\",\"Count\") ",
        "time_frame": {
          "relativeTime": 604800000
        },
        "viewOptions": {
          "type": "pie",
          "commands": [
            {
              "command": {
                "op": "=",
                "name": "subtype",
                "value": "full"
              }
            },
            {
              "command": {
                "op": "=",
                "name": "xaxis",
                "value": "xdm.logon.type"
              }
            },
            {
              "command": {
                "op": "=",
                "name": "yaxis",
                "value": "count_1"
              }
            },
            {
              "func": {
                "args": [
                  "\"NETWORK\"",
                  "\"#7876b6\""
                ],
                "name": "valuecolor"
              }
            },
            {
              "func": {
                "args": [
                  "\"INTERACTIVE\"",
                  "\"#f15050\""
                ],
                "name": "valuecolor"
              }
            },
            {
              "func": {
                "args": [
                  "\"SERVICE\"",
                  "\"#b7b797\""
                ],
                "name": "valuecolor"
              }
            },
            {
              "func": {
                "args": [
                  "\"count_1\"",
                  "\"Count\""
                ],
                "name": "seriestitle"
              }
            }
          ]
        }
      },
      "support_time_range": true,
      "additional_info": {
        "query_tables": [],
        "query_uses_library": false
      }
    },
    {
      "widget_key": "xql_1677409686512",
      "title": "Microsoft Windows Events - Top Events",
      "creation_time": 1677409686512,
      "description": "This widget displays the top Event ID's in a descending order",
      "data": {
        "phrase": "datamodel dataset in (microsoft_windows_raw)\n| filter xdm.observer.type=\"Microsoft-Windows-*\"\n| comp count(xdm.event.operation_sub_type) as `Action Count` by xdm.event.operation_sub_type\n| sort desc `Action Count` ",
        "time_frame": {
          "relativeTime": 604800000
        },
        "viewOptions": {
          "type": "table",
          "commands": []
        },
        "gridRawStorageInfo": {
          "sort": null,
          "coldefs": {},
          "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}",
          "columnWidth": "\"stretch\""
        }
      },
      "support_time_range": true,
      "additional_info": {
        "query_tables": [],
        "query_uses_library": false
      }
    },
    {
      "widget_key": "xql_1677410396873",
      "title": "Microsoft Windows Events - Failed Logins",
      "creation_time": 1677410396873,
      "description": "This widget displays failure logins in a 10 minute period",
      "data": {
        "phrase": "datamodel dataset in (microsoft_windows_raw)\n|filter xdm.observer.type contains \"Microsoft-Windows-\"\n|filter xdm.event.operation_sub_type=\"An account failed to log on\"\n|filter xdm.source.user.username !=\"-\"\n|bin _time span = 10M\n|comp count(xdm.event.operation_sub_type) as EventCount by _time\n| view graph type = line header = \"Failed Logins in 10 Minutes\" xaxis = _time yaxis = EventCount seriescolor(\"EventCount\",\"#1e83f7\") ",
        "time_frame": {
          "relativeTime": 604800000
        },
        "viewOptions": {
          "type": "line",
          "commands": [
            {
              "command": {
                "op": "=",
                "name": "header",
                "value": "\"Failed Logins in 10 Minutes\""
              }
            },
            {
              "command": {
                "op": "=",
                "name": "xaxis",
                "value": "_time"
              }
            },
            {
              "command": {
                "op": "=",
                "name": "yaxis",
                "value": "EventCount"
              }
            },
            {
              "func": {
                "args": [
                  "\"EventCount\"",
                  "\"#1e83f7\""
                ],
                "name": "seriescolor"
              }
            }
          ]
        }
      },
      "support_time_range": true,
      "additional_info": {
        "query_tables": [],
        "query_uses_library": false
      }
    },
    {
      "widget_key": "xql_1677418467521",
      "title": "Microsoft Windows Events - Top Actions",
      "creation_time": 1677418467521,
      "description": "This widget displays the common actions",
      "data": {
        "phrase": "datamodel dataset in (microsoft_windows_raw)\n|filter xdm.observer.type=\"Microsoft-Windows-*\"\n|comp count(xdm.event.operation_sub_type) as ActionCount by xdm.event.operation_sub_type\n| view graph type = pie subtype = full xaxis = xdm.event.operation_sub_type yaxis = ActionCount ",
        "time_frame": {
          "relativeTime": 604800000
        },
        "viewOptions": {
          "type": "pie",
          "commands": [
            {
              "command": {
                "op": "=",
                "name": "subtype",
                "value": "full"
              }
            },
            {
              "command": {
                "op": "=",
                "name": "xaxis",
                "value": "xdm.event.operation_sub_type"
              }
            },
            {
              "command": {
                "op": "=",
                "name": "yaxis",
                "value": "ActionCount"
              }
            }
          ]
        }
      },
      "support_time_range": true,
      "additional_info": {
        "query_tables": [],
        "query_uses_library": false
      }
    },
    {
      "widget_key": "xql_1678005649807",
      "title": "Microsoft Windows Events - Top Proccesses",
      "creation_time": 1678005649807,
      "description": "This widget displays the top proceeses running events",
      "data": {
        "phrase": "datamodel dataset in (microsoft_windows_raw)\n|filter xdm.observer.type=\"Microsoft-Windows-*\"\n|comp count(xdm.source.process.name) as `Count` by xdm.source.process.name\n|sort desc `Count`\n| view graph type = pie xaxis = xdm.source.process.name yaxis = Count ",
        "time_frame": {
          "relativeTime": 604800000
        },
        "viewOptions": {
          "type": "pie",
          "commands": [
            {
              "command": {
                "op": "=",
                "name": "xaxis",
                "value": "xdm.source.process.name"
              }
            },
            {
              "command": {
                "op": "=",
                "name": "yaxis",
                "value": "Count"
              }
            }
          ]
        },
        "gridRawStorageInfo": {
          "sort": null,
          "coldefs": {},
          "rowHeight": "{\"rowHeight\":\"regular\",\"gridRowsHeight\":\"medium-row\"}",
          "columnWidth": null
        }
      },
      "support_time_range": true,
      "additional_info": {
        "query_tables": [],
        "query_uses_library": false
      }
    }
  ],
  "fromVersion": "6.10.0",
  "supportedModules": [
    "xsiam"
  ]
}