QRadar WinCollect: How to use Microsoft Event Viewer to create an XPath Query

Example: Three queries are being used to send logs for these log types.

Important: When administrators use an XPath query, Windows Event Logs that you use to receive now need to be configured in the XPath query such as Application, Security, or System logs. XPath does not currently support Forwarding Events.

Procedure to use Microsoft Event Viewer to create an XPath query.

1. Log in to your host, where you have your WinCollect Agent installed.
2. Open Event Viewer by clicking Start > Run > type the command eventvwr.msc.
3. Click OK.
4. If you are prompted, type the Administrator password and press Enter.
5. Click Action > Create Custom View.
   Note: Do not use a time range from the Logged list. WinCollect® does not support it.
6. Click checkboxes for the Event Level requiring logging.
7. From the Event Logs drop-down menu, expand Windows logs and Application and Services logs.
8. Check the boxes that you would use for Microsoft Windows Event Logs.
   Note: XPath replaces standard log types. For more information, refer to QRadar: XPath Query Troubleshooting
9. Click the boxes for applications that you would like to log events.
10. Click OK.
11. Click the XML tab.
12. Cut and paste the XML code to an editor such as Notepad.
    Note: Applications such as Word® can leave the end of line characters that cause errors.
    
     
13. XPath queries only support a maximum of 10 logs. To confirm that you are not using more than 10 logs, click OK after saving the XML output to notepad or other text editors.
14. If you see a similar message, you have more than 10 logs. Click NO and repeat steps #6 through 12, un-select logs to resolve the Event Viewer 10 log message.
    
    
15. It is not required to save the custom view. Click Cancel.
16. Paste the XML output from step 12 in the XPath query text box on either Managed WinCollect or
    Stand-Alone WinCollect.
    
    
17. Create a parsing enhancement that uses the DSM Editor or by creating as Log Source Extension. Refer to the article, Creating a log source extension to get data into QRadar®.
18. Map all the Unknown events to QID.