Agent-Based Real-Time Event Log Monitoring
I am going to show you how to create am Agent-Based Real-Time Event Log Monitor Template so you can receive notification of critical events, such as domain administrator success logon events, from a remote server in real-time while bypassing WMI event subscriptions.
There are several reasons you would want to bypass WMI event subscriptions.
First, Windows Defender’s Attack Surface Reduction Rules block persistence through WMI event subscriptions. Meaning you can’t implement WMI event subscriptions which is how real-time agentless Event Log Monitoring is implemented on Windows.
Second, WMI event subscriptions are very slow to respond to remote server reboots and network failures.
Third, filtering must occur on the receiving side of WMI events which required every event to be transmitted over the network.
Corner Bowl Software solves these these issues with Corner Bowl Server Manager.
For more information see: https://www.CornerBowlSoftware.com/