SEAL EventLog Filter #1.00
//Rules version 14.7.1

[PROPERTIES]
Title=Default WIN7,2008+

[DESCRIPTION]
Default rules to sort events for Windows Vista, 7, 2008 and higher 
-------------------------------------------------------------------
For using File Access Audit rules must be enabled: 
1. "Audit objects access" in Local Security Policy (Local Policies -> Audit Policy). 
2. Auditing on selected directories, files (Security tab in Properties).  

Attention : After enabling "Audit object access" many other events are logged, we recommend to disable them. We also recommend increase size of Security Event Log.


[GROUP]
Name =NotImportant
//Color=Lime

[GROUP]
Name =Error
Color=Red

[GROUP]
Name =PowerAction
Color=C0C000


[REGISTRY RULE]

SET RegKey =HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*
SET RegValueName[1]=DisplayName
SET RegValueName[2]=DisplayVersion
SET RegValueName[3]=<KEY_NAME>

SET Message=Modified uninstall registry key for "%1, %2" (%3)
SET Group=Install


[RULE]
Channel=TXT:Microsoft-Windows-Application-Experience/Program-Inventory
EventID=903,904
ProviderID=TXT:{EEF54E71-0661-422D-9A98-82FD4940B820}

SET Message =Installed application, %3, %1, %2
SET Group=Supporting


[RULE]
Channel=TXT:Microsoft-Windows-Application-Experience/Program-Inventory
EventID=905,906
ProviderID=TXT:{EEF54E71-0661-422D-9A98-82FD4940B820}

SET Message =Updated application, %3, %1, %2
SET Group=Supporting

// the same rule if incorrect provider ID occurs :
[RULE]
Channel=TXT:Microsoft-Windows-Application-Experience/Program-Inventory
EventID=903..906

SET Group=Supporting

//=====================================================================

[RULE]
Channel=TXT:Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
EventID=21
ProviderID=TXT:{5D896912-022D-40AA-A3A8-4FA5515C76D7}

SET Message =Logged-on, %1, %3
SET Group=Login

SET StatMessage =Logged-on
SET StatKey     =%1


[RULE]
Channel=TXT:Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
EventID=23
ProviderID=TXT:{5D896912-022D-40AA-A3A8-4FA5515C76D7}

SET Message =Logged-off, %1
SET Group=LogOff


[RULE]
Channel=TXT:Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
EventID=24
ProviderID=TXT:{5D896912-022D-40AA-A3A8-4FA5515C76D7}

SET Message =Disconnected, %1, %3
SET Group=LogOff


[RULE]
Channel=TXT:Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
EventID=25
ProviderID=TXT:{5D896912-022D-40AA-A3A8-4FA5515C76D7}

SET Message =Reconnected, %1, %3
SET Group=Login


// the same rule if incorrect Provider ID occurs 
[RULE]
Channel=TXT:Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
EventID=21,23..25

SET Group=Login

//=====================================================================

[RULE]
Channel=TXT:System
Publisher=TXT:Microsoft-Windows-WindowsUpdateClient
EventID=19

ProviderID=TXT:{945A8954-C147-4ACD-923F-40C45405A658}

SET Message =Installed update, %1
SET Group=Install


[RULE]
Channel=TXT:System
Publisher=TXT:Microsoft-Windows-WindowsUpdateClient
EventID=23

ProviderID=TXT:{945A8954-C147-4ACD-923F-40C45405A658}

SET Message =Removed update, %1
SET Group=Install


// the same rule if incorrect Provider ID occurs 
[RULE]
Channel=TXT:System
Publisher=TXT:Microsoft-Windows-WindowsUpdateClient
EventID=19,23

SET Group=Install

//=====================================================================

[RULE]
Channel=TXT:System
Publisher=TXT:USER32
EventID=1072..1076

SET Group =PowerAction


[RULE]
Channel=TXT:System
Publisher=TXT:Microsoft-Windows-Kernel-General
EventID=12

SET Group =PowerAction

[RULE]
Channel=TXT:System
Publisher=TXT:EventLog
EventID=6008
SET Message = The previous system shutdown at %1 on %2 was unexpected. See BSOD details via application BlueScreenView : http://www.nirsoft.net/utils/blue_screen_view.html
SET Group =PowerAction

[RULE]
Channel=TXT:System
Publisher=TXT:Microsoft-Windows-Kernel-Power
EventID=41

SET Group =PowerAction

[RULE]
Channel=TXT:Security
Publisher=TXT:Microsoft-Windows-Security-Auditing
EventID=4608,4609

SET Group =PowerAction


[RULE]
Channel=TXT:Application
Publisher=TXT:MsiInstaller
EventID=1013,1033,1034,11500,11707,11708,11724,11725,11728

SET Group=Install


[RULE]
Channel=TXT:Application
Publisher=TXT:Application Error

SET Group =Error


[RULE]
Channel=TXT:Application
Publisher=TXT:Application Hang

SET Group =Error


[RULE]
Channel=TXT:Application
Publisher=TXT:Windows Error Reporting

SET Group =Error

//=====================================================================

[RULE]
Channel=TXT:Security
Publisher=TXT:Microsoft-Windows-Security-Auditing
EventId=4624
ProviderID=TXT:{54849625-5478-4994-A5BA-3E3B0328C30D}

SET SubstEventData[9] = 2:Interactive|3:Network|4:Batch|5:Service|7:Unlock|8:NetworkCleartext|9:NewCredentials|10:RemoteInteractive|11:CachedInteractive


//SET Message  =Logged on %9, %7\%6, %19
//SET Group =Login

SET Group =Excluded

SET HoldMsg  =SECL_4624_%8|, %9, %19, %18
SET HoldMsg  =SECS_4624_%8| (%9)



[RULE]
Channel=TXT:Security
Publisher=TXT:Microsoft-Windows-Security-Auditing
EventId=4672
ProviderID=TXT:{54849625-5478-4994-A5BA-3E3B0328C30D}
EventData[1] = NOT RE: +I :NT AUTHORITY\\SYSTEM|NT AUTHORITY\\NETWORK SERVICE|NT AUTHORITY\\LOCAL SERVICE

SET Message  =Special logon, %3\%2<HoldMsg SECL_4624_%4>
SET Group =AdminLogin
SET SubGroup =Security + Login

SET StatMessage =Special logon
SET StatKey     =%3\%2<HoldMsg SECS_4624_%4>



[RULE]
Channel=TXT:Security
EventType = Critical , Error

SET Group=Error
SET SubGroup =Security



[RULE]
Channel=TXT:Security
Publisher=TXT:Microsoft-Windows-Security-Auditing
EventId=4717,4722,4731,4735,4738,4781,4907

SET Group =Security


[RULE]
ChannelType = Admin
EventType = Critical , Error

SET Group=Error

[RULE]
ChannelType = Operational
EventType   = Critical , Error

SET Group=Error


// filtering/categorization of all results obtained by rules written above 
// note : 
// [RULE] or [RULE0] are equivalent, first level of rules   
// [RULE N] are lower N-level of rules

[RULE 1]
Publisher=TXT:Microsoft-Windows-WMI
EventID=10

SET Group=Excluded

[RULE 1]
Publisher=TXT:Microsoft-Windows-CAPI2
EventID=4107

SET Group=Excluded

[RULE 1]
Channel=TXT:Security
Publisher=TXT:Microsoft-Windows-Security-Auditing
EventId=4672
Description=RE: +I :UNLOCK

SET Group=Excluded


//====================FileAudit====================

[GROUP]
Name        =FileAudit
Description =Auditing files by local policy
Color       =Fuchsia


[RULE]
Channel  =TXT:Security
Publisher=TXT:Microsoft-Windows-Security-Auditing
EventID  =4663

SET Message =Account: %3\%2 Logon ID: %4 Object Name: %7 Process Name: %12 Access: %9
SET Group   =FileAudit

//====================UserManagement====================

[GROUP]
Name        =UserManagement
Description =Auditing User Management
Color       =Black


[RULE]
Channel  =TXT:Security
Publisher=TXT:Microsoft-Windows-Security-Auditing
EventID  =4728

SET Message = User: %6 with Logon ID: %9 added user: %2 to global group %5
SET Group   =UserManagement


[RULE]
Channel  =TXT:Security
Publisher=TXT:Microsoft-Windows-Security-Auditing
EventID  =4729

SET Message = User: %6 with Logon ID: %9 removed user: %2 from global group %5
SET Group   =UserManagement


[RULE]
Channel  =TXT:Security
Publisher=TXT:Microsoft-Windows-Security-Auditing
EventID  =4732

SET Message = User: %6 with Logon ID: %9 added user: %2 to local group %5
SET Group   =UserManagement


[RULE]
Channel  =TXT:Security
Publisher=TXT:Microsoft-Windows-Security-Auditing
EventID  =4733

SET Message = User: %6 with Logon ID: %9 removed user: %2 from local group %5
SET Group   =UserManagement

[RULE]
Channel  =TXT:Security
Publisher=TXT:Microsoft-Windows-Security-Auditing
EventID  =4756

SET Message = User: %6 with Logon ID: %9 added user: %2 to universal group %5
SET Group   =UserManagement


[RULE]
Channel  =TXT:Security
Publisher=TXT:Microsoft-Windows-Security-Auditing
EventID  =4757

SET Message = User: %6 with Logon ID: %9 removed user: %2 from universal group %5
SET Group   =UserManagement

[RULE]
Channel  =TXT:Security
Publisher=TXT:Microsoft-Windows-Security-Auditing
EventID  =4720

SET Message = User: %4 with Logon ID: %7 created account: %3 
SET Group   =UserManagement


[RULE]
Channel  =TXT:Security
Publisher=TXT:Microsoft-Windows-Security-Auditing
EventID  =4726

SET Message = User: %4 with Logon ID: %7 removed account: %2\%1   
SET Group   =UserManagement

[RULE]
Channel  =TXT:Security
Publisher=TXT:Microsoft-Windows-Security-Auditing
EventID  =4724

SET Message = User: %4 with Logon ID: %7 changed password for account %3.
SET Group   =UserManagement

//====================RightsManagement====================

[GROUP]
Name        =RightsManagement
Description =Auditing rights management for folder
Color       =Black

[RULE]
Channel  =TXT:Security
Publisher=TXT:Microsoft-Windows-Security-Auditing
EventID  =4670

SET Message = Subject %3\%2 with logon ID: %4 has changed permissions for object: %7. Object type: %6. Change: %13.
SET Group   =RightsManagement