Download a pre-configured global filter that allows you to configure all your Logmanager Windows Agents in a single step so that different Windows sources send different types of events.

Download Filter

This global filter is intended for users who need to connect hundreds or even thousands of Windows agents to Logmanager and configure different groups of agents to send different types of events.

The filter is ready to use immediately. At the same time, it serves as an example of the available possibilities and underlying principles. You can modify it, change source name patterns, adjust what is filtered, or add additional conditional branches to fit your environment.

What Problems Does This Global Filter Solve?

Logmanager Windows Agent is software for Windows servers and endpoints that collects events and logs directly from Windows and securely forwards them to Logmanager. It also enables centralized management through the Logmanager web interface. Using filters, the agent can be configured to forward only selected Windows events.

Configuring specific filters across a large number of Logmanager Windows Agents can be time-consuming, as it typically requires accessing each device individually and configuring rules manually.

This global filter significantly simplifies that process. In a single configuration step, you can define which events should be sent to Logmanager based on either a portion of the source system name or its full hostname.

For example, you can collect different types of events from critical servers, standard servers, and workstations. In practice, you might choose to collect only logon events from all desktop PCs, while collecting both user logon events and VPN connection events from laptops.

This filter is particularly useful for organizations that:

  • Have a large number (hundreds to thousands) of Windows sources connected to Logmanager.
  • Need to filter Windows events based on the source hostname.
  • Have a small number of systems that require exceptions to the standard rules.
  • Use a consistent naming convention for Windows devices. For example, all workstations begin with PC (or Pc, pc, etc.), while all laptops begin with NTB (or Ntb, ntb, etc.).

Applying the Filter

global filter setup windows

Applying the filter is straightforward:

  1. Open the Sources section in the Logmanager web interface.
  2. Navigate to Beats Filters.
  3. Create a new filter and assign it a name.
  4. Paste the downloaded filter into the XML tab.

Practical Example

Global filter setup for windows agents
  • If the source name begins with “PC”, all events are discarded except Event IDs 4624 and 4625 (successful and failed logon events).
  • If the source name begins with “NTB”, all events are discarded except Event IDs 4624 and 4625 (successful and failed logon events) and Event IDs 20225 and 20226 (VPN connection and disconnection events).
  • If the source name is not DC01, DC02, EXCHANGE, or CA01, all events are discarded except those from the System, Security, and Application channels.

In all other cases (that is, when the source name is DC01, DC02, EXCHANGE, or CA01), no events are discarded and all events are forwarded to Logmanager. For all other servers, only events from the System, Security, and Application channels are forwarded.