Create a query to show event ID's

[ryan190]

Hi

How do I create a query to show only if computers are reporting back a given event ID or event description?

I want to see which computers are reporting Event ID 1119 and event description "The update failed; see event log"

[cdinet]

You can create a new query, type would be threat events, add query type and desired columns, then filter it for the threat event ID

[ryan190]

Hello

When i try and look for a filter on Event ID nothing is being displayed

[cdinet]

There should be a filter for threat event ID.

[vivs · Accepted solution]

Hello,

Try this and check whether this is working or not for you:

1) 

2) 
Click Next and again click on Next and configure the event ID:

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

[cdinet]

Thanks @vivs , I didn't have my server up to get screenshots 🙂