Technical Tip: How to configure Agent Template -> User Log

[flunaibarra]

Description	This article describes how to configure the User Log in a Windows template configuration.
Scope	FortiSIEM, Windows Agent.
Solution	From the Windows Server - Get the path and file name of the file that will be monitored. Example: C:\Temp\Folder\setupact.log. Note the correct file extension and the prefix to use. Create the configuration in SIEM - Windows Agent template configuration -> User Log. Create an association and press the Apply button for the changes to take effect. Run an Analytics Query with the following attributes: Reporting IP             =              <Host_IP> Raw Event Log    CONTAIN     WUA-UserFile Note: If the monitoring file doesn't create new log lines while monitoring, no events will show up in Analytic. To test, open the file, copy some lines that contain the prefix and paste them at the end of the file -> Save. Run the Analytic Query again. If the path or file name is incorrectly entered in the template configuration, an event will be sent indicating: 'The system cannot find the file specified.'