Creating Custom DCR to exclude logging of certain EventID

Question

Creating Custom DCR to exclude logging of certain EventID

Hardavinder Bhinder 20

Hi I am trying to create a DCR rule for Windows Security Events via AMA data connector to exclude certain Event IDs and services using a XPath query. I have tried the following queries but it does not work:

Security!*[System[(EventID != 4624)]]

Security!*[System[not(EventID=4624)]]

Could you please provide any suggestions on how to get this working correctly? Any insights would be greatly appreciated.

Naveena Patlolla 3,605 Reputation points Microsoft External Staff Moderator

2025-03-31T10:21:11.7366667+00:00
Hi Hardavinder Bhinder

You can use the PowerShell cmdlet Get-WinEvent with the FilterXPath parameter to test the validity of an XPath query locally on your machine first.The following script shows an example:

$XPath = '*[System[EventID=1035]]' Get-WinEvent -LogName 'Application' -FilterXPath $XPath

Additionally, remember that Azure Monitor agent supports XPath version 1.0, so ensure your query adheres to the limitations and syntax rules of that version.

Please refer to the below documents

https://learn.microsoft.com/en-us/azure/azure-monitor/vm/data-collection-windows-events#extract-xpath-queries-from-windows-event-viewer

https://learn.microsoft.com/en-us/windows/win32/wes/consuming-events#xpath-10-limitations

Accepted answer

0 additional answers

Your answer

Naveena Patlolla 3,605 Reputation points Microsoft External Staff Moderator

2025-03-31T10:21:11.7366667+00:00

Hi Hardavinder Bhinder

You can use the PowerShell cmdlet Get-WinEvent with the FilterXPath parameter to test the validity of an XPath query locally on your machine first.The following script shows an example:

$XPath = '*[System[EventID=1035]]' Get-WinEvent -LogName 'Application' -FilterXPath $XPath

Additionally, remember that Azure Monitor agent supports XPath version 1.0, so ensure your query adheres to the limitations and syntax rules of that version.

Please refer to the below documents

https://learn.microsoft.com/en-us/azure/azure-monitor/vm/data-collection-windows-events#extract-xpath-queries-from-windows-event-viewer

https://learn.microsoft.com/en-us/windows/win32/wes/consuming-events#xpath-10-limitations

Answer 1

Hi,

Syntax like

Security!*[System[(EventID!=4624)]]

is correct.

If you already have existing data collection rule edit that rule instead of creating new one. If you create a new one to exclude event ID that is collected via another data collection rule that will not work. Also it depends what kind of configuration you are using for Windows Security events - All, Common or Minimal. If it is Common or Minimal you just need to remove the event ID that you want to exclude in the xPathQuery rather adding value for exclusion. If you use All you will need to add the xPath query to exclude the event.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Share via

Creating Custom DCR to exclude logging of certain EventID

0 additional answers

Your answer