Include Parameter

[louissanchez84]

Is there a way to include only specific accounts and groups in monitoring? I know there is an ignore type parameter, but didn't see anyway to specify sensitive groups and accounts only.

[PrzemyslawKlys]

In Legacy Edition - no.
In New Hope Edition - partially. It's supported in Per event mode only. I've introduced the ability to define the priority of events based on condition. It still processes each of the event but if the condition isn't matched it drops it.

    GroupMembershipChanges  = @{
        Enabled  = $true
        Events   = @{
            Enabled     = $true
            Events      = 4728, 4729, 4732, 4733, 4746, 4747, 4751, 4752, 4756, 4757, 4761, 4762, 4785, 4786, 4787, 4788
            LogName     = 'Security'
            IgnoreWords = @{
                'Who' = '*ANONYMOUS*'
            }
            Fields      = [ordered] @{
                'Computer'            = 'Domain Controller'
                'Action'              = 'Action'
                'TargetUserName'      = 'Group Name'
                'MemberNameWithoutCN' = 'Member Name'
                'Who'                 = 'Who'
                'Date'                = 'When'

                # Common Fields
                'ID'                  = 'Event ID'
                'RecordID'            = 'Record ID'
                'GatheredFrom'        = 'Gathered From'
                'GatheredLogName'     = 'Gathered LogName'
            }
            SortBy      = 'When'
        }
        Priority = @{
            High = @{
                # 'Domain Controller' = ''
                # 'Action'            = ''
                # 'User Affected'     = ''
                # 'Who'               = '*Admin*'
                # 'When'              = ''
                # 'Event ID'          = ''
                # 'Record ID'         = ''
                'Group Name' = '*Server*'
            }
        }
    }

However, keep in mind that this is not yet described. there is no documentation. You're a bit on your own with this one as surely there are some bugs here and there. You can define multiple priorities (priority name doesn't matter). The clue is that you need to define it per event type but also per service (so if you are working with emails you need to define priorities in the email section. If in teams .. in teams and so on.

The goal of this was that you would have a low priority channel for teams, slack, email where all events would go and other priorities sending stuff elsewhere.

Alternatively, if you go to https://evotec.xyz/powershell-everything-you-wanted-to-know-about-event-logs/ there is a process described where PSEventViewer is able to generate your XML which you can use in the forwarding system. This way only events with a particular name would be forwarded and any version of PSWinReporting would work. It's not really straight forward thou.

If you can wait for this feature will surely be expanded in New Hope edition. When.. that is good question.