Configuration File [WinEvent]

These settings are only required if using WinEvent as an Alert Method.

[WinEvent] Logname

The logname should be Application though this is configurable. If changed, be sure to update the New-EventLog command to reflect this change.

Example Value

LogName = Application

[WinEvent] EntryType

Select one of the following: Error, FailureAudit, Information, SuccessAudit, Warning

Example Value

EntryType = Warning

[WinEvent] Source

By default WebsiteFailedLogins source isn't registered. To do so, run the following command to register WebsiteFailedLogins or choose your own.

Register Event Source

New-EventLog -LogName Application -Source WebsiteFailedLogins

Example Value

Source = WebsiteFailedLogins

[WinEvent] FailedLoginsPerIPEventId

Event Id when logging an IP that exceeds threshold FailedLoginsPerIP.

Example Value

FailedLoginsPerIPEventId = 10

[WinEvent] TotalFailedLoginsEventId

Event Id logged when all failed requests exceed threshold TotalFailedLogins.

Example Value

TotalFailedLoginsEventId = 20