Logs and Events

EventHorizon maintains an event provider that can be viewed through the Windows Event Viewer. From this provider are 3 channels:

1. Telemetry: All telemetry collected by EventHorizon in the form of JSON objects
2. Detections: Detections that have been triggered as well as loaded rules
3. Status: Service status messages and errors

Below is a table of events, their channels, IDs

Event Name	ID	Channel	Description
EVT_TELEMETRY_DATA	100	Telemetry	New event
EVT_DETECTION	200	Detections	Detection fired
EVT_DETECTION_ERROR	201	Detections	Detection error occurred
EVT_DETECTION_RULE_LOAD	202	Detections	Detection rule was loaded into detection engine
EVT_DETECTION_RULE_LOAD_ERROR	203	Detections	Detection engine encountered a problem loading a rule
EVT_STATUS_SERVICE	300	Status	An EventHorizon service status changed (Start/Stop)
EVT_STATUS_SERVICE_ERROR	301	Status	An EventHorizon service encountered an error
EVT_STATUS_TELEMETRY	302	Status	Telemetry service status update
STATUS_TELEMETRY_ERROR	303	Status	Telemetry service encountered an error