Windows Event Monitoring

Windows Event Monitoring collects and alerts on configured Windows Event Log signals so operations and security teams can detect system-level failures, security-relevant activity, and repeated event patterns that need investigation.

When To Use It

• Use Windows Event Monitoring when a Windows host event log, event ID, source, provider, or event pattern needs operational review.
• Use Health Monitoring when the primary signal is CPU, memory, disk, disk I/O, telemetry freshness, or agent status.
• Use Endpoint Monitoring when the primary risk is whether a URL or application endpoint responds successfully.
• Use Certificate, DNS, and Domain Monitoring for certificate, resolver, and domain-continuity risks instead of host event logs.

Supported Windows Hosts

Prerequisites And Permissions

• A supported Windows Server host with the Bitaic Windows Event agent installed as a Windows service.
• Local Administrator rights to install, upgrade, or uninstall the agent.
• Runtime collection through NT SERVICE\BitaicWindowsEventAgent by default, or a customer-managed non-interactive service account with equivalent event-log read access.
• Event Log Readers membership or explicit channel read ACLs for Application, System, and custom channels.
• The Windows privilege that permits managing auditing and the Security log when Security log collection is enabled.
• Outbound HTTPS on TCP 443 to api.bitaic.com and ingest.bitaic.com. Install and update workflows may also use downloads.bitaic.com.

Event Log Scope

Filters And Alerts

Windows Event Monitoring rules match selected logs, levels, event IDs, sources, providers, keywords, exclusions, or XPath predicates. A matched event can open an alert immediately, while event-rate rules detect noisy or repeated patterns over a time window.

Default operational rules watch Application and System for critical, error, and warning events, suppress repeated matches for 15 minutes, and exclude routine Service Control Manager event ID 7036. If Security is enabled without explicit event IDs, Bitaic collects high-signal audit events such as 1102, 4625, 4719, 4720, 4726, 4732, 4738, 4740, 4771, and 4776.

Collection Runtime

Data And Status

• Host identity, OS version, architecture, and agent status.
• Event log name, event ID, event level, source, and provider.
• Event timestamp, keywords or audit outcome when available, rule name, and match reason.
• Collection status, event state, alert state, and checked time.

Configuration Example

windows-event-agent-config.yml
agent:
  collection_mode: subscription
  checkpoint_interval_seconds: 30
  local_buffer_hours: 24
  local_buffer_max_mb: 100
windows_events:
  - name: service-control-failures
    logs:
      - System
    levels:
      - critical
      - error
      - warning
    event_ids:
      - 7031
      - 7034
    sources:
      - Service Control Manager
    exclude_event_ids:
      - 7036
    dedupe_window_minutes: 15
    event_rate:
      window_minutes: 5
      threshold: 10
      severity: warning

Example Workflow: Alert on Service Failures

Goal: watch a Windows Server host for repeated service-control failures, route matched events to the responsible responder, and keep enough context for operational or security review.

1. Confirm the host is running a supported Windows Server version and the agent service can reach Bitaic over outbound HTTPS.
2. Grant the agent runtime identity read access to the required event log channels, including the Security log only when Security collection is needed.
3. Configure the event log, event levels, event IDs, sources, exclusions, dedupe window, and event-rate threshold.
4. Start or refresh collection, then confirm the dashboard shows a running collection status and recent event timestamp.
5. Review matched events with host, log, event ID, level, source, provider, event time, event state, and alert state.

CLI And API

Bitaic CLI workflows inspect Windows Event Monitoring status and matched events. Event rule create, update, and delete workflows remain managed through the dashboard, API, or configuration file.

bitaic windows-events status --host <host_name>
bitaic windows-events list --host <host_name> --log <log_name> --level <level> --event-id <event_id> --since <timestamp_or_duration>

Status output includes host, os_version, agent_status, collection_status, watched_logs, default_levels, last_event_at, buffered_events, matched_events, alert_state, and checked_at. Event-list output includes host, log, event_id, level, source, provider, event_time, event_state, and alert_state.

• Create or list monitored Windows hosts with /v1/workspaces/{workspace_id}/targets and type: "windows_host".
• Attach or update event rules with /v1/workspaces/{workspace_id}/targets/{target_id}/checks or /v1/workspaces/{workspace_id}/checks/{check_id} and type: "windows_event_rule".
• Retrieve matched events with /v1/workspaces/{workspace_id}/events/windows and alert records with /v1/workspaces/{workspace_id}/alerts.