Capture every signal your L3 engineers need to solve tough ticket fast.

WorkloadLive

Domain controller

The agent reports the domain controller host role for this machine.

The directory service, Netlogon and Windows Time services are present on the host.

Covered bySecurity logSystem logServicesSystem identitydirectory object changeddirectory replication access requesteddirectory object access denied

WorkloadLive

Hyper-V host

The Hyper-V Virtual Machine Management service is present on the host.

Covered bySystem logSecurity logServicesProcesses+1vswitch config restore failedpsdirect handshake probe

WorkloadLive

SQL Server

The SQL Server and SQL Server Agent services are present on the host.

A named instance service such as MSSQL$PAYROLL is present. A SQL Server VSS writer service is present and reports state during a backup.

Covered byApplication logSystem logServicesProcesses+2mssql db corruptionvss data integrity writer failed

Event feeds14

Event feedLive2 changes

Microsoft Defender

Microsoft Defender Antivirus detections, remediation outcomes and engine health from the Defender operational channel.

Collected, curated, and searchable

av config changedav definition update failedav engine failed

Event feedLive

Application log

The Application channel: application crashes and hangs, database and VSS provider faults, certificate and identity-sync failures.

Collected, curated, and searchable

adcs ca chain failedadcs crl publish failedapp crash

Event feedLive12 changes

Security log

The Security channel: sign-in outcomes, privilege use, directory changes and audit policy changes.

Collected, curated, and searchable

account changedaccount createdaccount deleted

Event feedLive

Setup log

The Setup channel: update and feature install outcomes as Windows itself records them.

Collected, curated, and searchable

win component store scan found corruptionwin servicing package state change failed

Event feedLive1 change

System log

The System channel: service, driver, disk, network, cluster and hardware faults from the operating system itself.

Collected, curated, and searchable

av unsigned code blockedbugcheckcluster csv unavailable

Event feedLive

PowerShell

PowerShell engine and script-block channels, with whole script blocks reassembled and labelled for generated framework code, repeats and watchlisted commands.

Collected, curated, and searchable

win powershell script block framework codewin powershell script block repeatwin powershell script block watchlist hit

Event feedLive

CBS log

Component-Based Servicing: what the servicing stack actually did to a package, and why it stopped.

Collected, curated, and searchable

win component store assembly missingwin component store corrupt blocks packagewin component store corruption recurrence

Event feedLive

DISM log

DISM servicing operations: image and component-store maintenance and their failure detail.

Collected, curated, and searchable

win dism command failedwin dism feature change failedwin dism health command run

Event feedPlannedCollected

App platform channels

Application platform channels beyond the classic Application log, collected for search and correlation.

Collected and searchable

Event feedPlannedCollected

Identity channels

Identity and security operational channels beyond the classic Security log, collected for search and correlation.

Collected and searchable

Event feedPlannedCollected

Management channels

Remote management, task scheduling and configuration channels, collected for search and correlation.

Collected and searchable

Event feedPlannedCollected

Network channels

Networking operational channels beyond the classic System log, collected for search and correlation.

Collected and searchable

Event feedPlannedCollected

Platform channels

Core platform operational channels, collected for search and correlation.

Collected and searchable

Event feedPlannedCollected

Storage channels

Storage operational channels beyond the classic System log, collected for search and correlation.

Collected and searchable

Config Changes14

Config changeLive

Account

A user or computer account in the directory or on the local host.

5 actions · 9 reasons · 1 sources

createddeleteddisabled

Config changeLive

Audit policy subcategory

One subcategory of the Windows audit policy, which decides what the Security log records.

1 actions · 1 reasons · 1 sources

updated

Config changeLive

Endpoint protection setting

One setting of the endpoint protection product on the host.

1 actions · 1 reasons · 1 sources

updated

Config changeLive

Endpoint protection component

One protection component of the endpoint protection product, such as real-time scanning.

2 actions · 1 reasons · 1 sources

disabledenabled

Config changeLive

Directory object

A directory object that is neither an account nor a group, such as an organizational unit or a policy container.

3 actions · 1 reasons · 1 sources

createddeletedupdated

Config changeLive

Domain policy

The password and lockout policy of one domain.

1 actions · 1 reasons · 1 sources

updated

Config changeLive

Firewall rule

One rule in the Windows Firewall, which decides what traffic the host accepts.

5 actions · 1 reasons · 1 sources

createddeleteddisabled

Config changeLive

Security group

A security group, both the group itself and who belongs to it.

5 actions · 5 reasons · 1 sources

createddeletedmember_added

Config changeLive

Logon right

A right that decides how an account may sign in, such as locally at the keyboard or as a service.

2 actions · 2 reasons · 1 sources

createddeleted

Config changeLive

Registry value

A value in the Windows registry that auditing is turned on for.

3 actions · 1 reasons · 1 sources

createddeletedupdated

Config changeLive

Scheduled task

A job Task Scheduler runs on a trigger or a clock.

4 actions · 4 reasons · 1 sources

createddeleteddisabled

Config changeLive

Network share

A folder the host publishes on the network over SMB.

1 actions · 1 reasons · 1 sources

created

Config changeLive

System clock

The clock of the host the event came from.

1 actions · 1 reasons · 1 sources

updated

Config changeLive

Windows service

A background program the Service Control Manager starts and stops on the host.

1 actions · 1 reasons · 2 sources

installed

Device health20

Device healthLive

Collector health

Per-collector health for the shipper the agent runs.

Collected, curated, and searchable

Device healthLive

Volumes

Every fixed volume: free space, fill trend, protection state and whether the filesystem is readable.

Collected, curated, and searchable

BitLocker protection droppeddata volume running out of spacedata volume space low

Device healthLive

Drivers

The device drivers installed on the host, and what changes about them between reports.

Collected, curated, and searchable

driver updateddriver addeddriver removed

Device healthLive

Feed health

Per-feed health for the inputs the agent is shipping.

Collected, curated, and searchable

Device healthLive

Products

The installed-product inventory the agent reads from the host.

Collected, curated, and searchable

product installedproduct removedproduct version changed

Device healthLive

Product summary

A rolled-up view of installed products, including protection-category coverage.

Collected, curated, and searchable

Device healthLive

Device IO

Per-device IO posture, including a device that is busy but moving almost nothing.

Collected, curated, and searchable

disk unresponsive

Device healthLive

Devices

The physical and virtual storage devices attached to the host.

Collected, curated, and searchable

Device healthLive

Storage IO

Storage throughput, queueing and response time per device.

Collected, curated, and searchable

disk latency degradeddisk saturated

Device healthLive

System identity

Machine identity and posture, including whether a reboot is pending.

Collected, curated, and searchable

reboot pendingSecure Boot state changedTPM state changed

Device healthLive

Volume map

How volumes map onto devices and partitions.

Collected, curated, and searchable

Device healthLive

Shadow storage

Shadow-copy storage allocation and how close it is to its cap.

Collected, curated, and searchable

shadow storage near capshadow copies failing for space

Device healthLive

Writers

VSS writer state, the canonical evidence behind a failed backup.

Collected, curated, and searchable

VSS writer failed

Device healthPlanned

Agent overhead

What the SparkLogs agent stack itself costs the host: CPU, working set and handles.

Collected, curated, and searchable

agent cpu over budgetagent handle over budgetagent ram over budget

Device healthPlanned

Agent pipeline

The agent spool and delivery pipeline: how much is queued and when it last drained.

Collected, curated, and searchable

Device healthPlanned

Crash dumps

Whether this host can produce a usable crash dump, and whether it recently did.

Collected, curated, and searchable

recurring crash dumpsnew crash dumppage file too small for the dump

Device healthPlanned

Performance

Whole-host CPU and memory posture over a measured window.

Collected, curated, and searchable

cpu busycpu interrupt stormcpu kernel dominated

Device healthPlanned

Processes

Per-process cost: CPU, working set, handles and sustained growth.

Collected, curated, and searchable

process handle count highprocess memory growing

Device healthPlanned

Services

Service configuration and run state, including automatic services that are not running.

Collected, curated, and searchable

automatic service not runningsvc flappingservice stuck pending

Device healthPlanned

Windows Update

Whether this host is scanning, paused, or falling behind on updates.

Collected, curated, and searchable

update scan is staleupdates paused

Shippers5

ShipperLiveCollected

Alloy

Ship logs to SparkLogs with Grafana Alloy.

Collected and searchable

ShipperLiveCollected

Filebeat

Ship logs to SparkLogs with Filebeat and the other Elastic Beats.

Collected and searchable

ShipperLiveCollected

Logstash

Ship logs to SparkLogs with Logstash.

Collected and searchable

ShipperLiveCollected

OTel Collector

Ship logs to SparkLogs with the OpenTelemetry Collector.

Collected and searchable

ShipperLiveCollected

Vector

Ship logs and metrics to SparkLogs with Vector.

Collected and searchable

Protocols5

ProtocolLiveCollected

Elasticsearch bulk

Send events using the Elasticsearch bulk API shape.

Collected and searchable

ProtocolLiveCollected

HTTPS JSON

Post JSON events to the SparkLogs ingest endpoint directly.

Collected and searchable

ProtocolLiveCollected

Loki push

Send events using the Loki push API shape.

Collected and searchable

ProtocolLiveCollected

OTLP

Send logs to SparkLogs over the OpenTelemetry protocol.

Collected and searchable

ProtocolLiveCollected

Syslog

Send syslog to SparkLogs from network devices and appliances.

Collected and searchable