Collect AppLocker Events

Microsoft.SystemCenter.CollectAppLockerEventExeAndDll (Rule)

This rule collects events from the AppLocker EXE and DLL event log and sends them to the cloud

Element properties:

Member Modules:

Source Code:

<Rule ID="Microsoft.SystemCenter.CollectAppLockerEventExeAndDll" Target="Windows!Microsoft.Windows.Computer" Enabled="false" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider" RunAs="System!System.PrivilegedMonitoringAccount">

      <ComputerName>$Target/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Microsoft-Windows-AppLocker/EXE and DLL</LogName>

      <Expression>

        <RegExExpression>

          <ValueExpression>

            <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

          </ValueExpression>

          <Operator>MatchesRegularExpression</Operator>

          <Pattern>^(8001|8002|8003|8004|8222)$</Pattern>

        </RegExExpression>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="HttpWA" TypeID="IPTypes!Microsoft.SystemCenter.CollectThreatCloudEvent"/>

  </WriteActions>

</Rule>