Windows Event Monitoring

Windows Event Monitoring collects and alerts on configured Windows events so operations and security teams can detect system-level issues, security-relevant activity, and event patterns that need investigation.

What Windows Event Monitoring Checks

• Windows events from configured hosts and event logs.
• Selected event IDs, severities, levels, and sources.
• Event timestamps and host identity for investigation context.
• Alert state for watched events and event patterns.
• Dashboard summaries for recent events and alert history.

When To Use It

• Use Windows Event Monitoring to identify host-level events that may indicate operational failures, service issues, or security-relevant behavior.
• Use Health Monitoring to track resource metrics such as CPU, memory, disk usage, and agent status.
• Use Endpoint Monitoring to verify application or service availability from the network perspective.

Data And Alerts

• Host identity.
• Event log name.
• Event ID.
• Event severity or level.
• Event source and timestamp.
• Alert state.

Windows Event Monitoring alerts on selected event IDs, severities, sources, or event-rate patterns. Alert routing uses the same notification and incident integrations as the rest of the Bitaic monitoring platform.

Configuration Example

windows_events:
  - log: System
    levels:
      - Error
      - Critical
    event_ids:
      - 7036

CLI And API

Bitaic CLI and API workflows cover inspecting Windows Event Monitoring status and reading Windows event alerts or summaries.