Document toolboxDocument toolbox

Windows Monitoring

Owned by Juan Tomás Alonso Nieto (Deactivated)
Jul 06, 2022
3 min read

The Windows Monitoring app is used to collect and visualize detailed system statistics from Windows systems. It allows you to analyze windows events, users, and machines.

It can be installed from Exchange, Devo's marketplace for apps. Once installed it appears on the navigation panel under the Applications section.

Windows Monitoring is a board, with different widgets containing graphs or data about Windows users and systems. It is similar in appearance to an Activeboard. The widgets are predefined and cannot be changed. 

All the data you need from Windows is presented in a series of widgets. They automatically generate content using data from the box.win table, where data from your Windows machines is stored when provided to Devo.

There is a gear icon at the top right side of Windows Monitoring. It opens the settings window that allows you to configure the date range of the data used to render the widgets.

The information is categorized by types and includes the analysis of Windows Events for authentication, systems, and security, thus covering both user's behavior and system status use cases.

There are several views located each on its own tab. They collect related widgets. For example:

  • Overview

  • Authentication

  • System 

  • Security

Overview tab contains selections of all the widgets.

The authentication tab contains widgets such as:

  • Successful Logins

  • Logins per day from public IPS by username

  • Successful logins

The System tab contains widgets such as:

  • Executed processes

  • Services installed

  • System logs

The Security tab contains widgets such as:

  • Applications installed

  • Applications removed

  • Applications install attempts

  • Applications removal success

  • Objects deleted

  • Access to removable objects



With Windows monitoring it is possible to analyze:

  • Services installed

  • Objects deleted

  • Successful logins

  • EnventID log

  • Logins per day

  • Executed processes

  • applications installed

  • Applications removed

  • System Log

  • Failed logins

  • and many more.

Do you need others to see this information as well? Activating the app will give access to all users in the domain so you do not need to worry about this.

 Â