FrameFlow's Logon Security Event Monitor keeps track of your Windows logins and generates alerts based on the settings you choose. You can receive alerts about events like suspicious login attempts and logins from unauthorized users. You can also choose to ignore certain login events and attempts that are not of concern. This tutorial will walk you through this event monitor's features.

To begin, select the level of alert you want to receive if your device cannot be contacted.

Connection Settings

After that, choose the level of alert you'd like to receive if the event monitor detects one or more failed login attempts.

Failed Login Attempt Option

The next two settings allow you to ignore certain login events. Check the first box to ignore login events that don't necessarily fail, but indicate that additional pre-authentication is required. The second box, when checked, will ignore failed login attempts from users with valid accounts who have gotten their passwords wrong.

"Ignore" Options

The next two options let you list out both permitted and banned user accounts. Enter a comma-separated list of permitted users in the first field. If the event monitor detects any user who is not part of this group, it will warn you with your choice of alert level. In the second text box, you can add a list of banned users. You will receive an alert if any of the users listed there attempt to log in. Separate different usernames with commas.

Permitted and Banned User Fields

Expanding the final checkbox will reveal options that control alerting about locked/unlocked account events. The first one will alert you if there's a locked/unlocked account event with any of the usernames you enter in the text field. The second option lets you specify user accounts that will be ignored in a locked/unlocked account event. Separate the values you enter into each of these fields with commas.

Locked/Unlocked Accounts Settings

This tutorial taught you about the options available within the Logon Security Event Monitor. For a more in-depth look at each step needed to get this event monitor up and running, you can find further reading in the Logon Security Event Monitor reference guide. Check out our new Use Cases section for more inspiration on how to use our services!

More IT Monitoring Features