Information Centric Tagging Event Parser

Products

• Information Centric Security

Issue/Introduction

This article explains how to install and interpret the Information Centric Tagging (ICT) Event logs in the Event viewer.

The Event Parser was built to read the RAW ICT Windows Event logs created by the ICT client, in a friendly format.

Resolution

Installation

1. copy rw-eventlogmessages.dll to a location that is always accessible by the operating system:
   1. For a x86 based Operative Systems: 
      x86\rw-eventlogmessages.dll
   2. For x64 based Operative Systems: 
      x64\rw-eventlogmessages.dll
2. Create the following registry key:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\Information Centric Tagging

3. On this registry key, create the following registry values:

   Value Name	Value Type	Value Data
   CategoryCount	REG_DWORD	0x00000003
   CategoryMessageFile	REG_SZ	Full path of rw-eventlogmessages.dll Eg.: C:\filter\rw-eventlogmessages.dll
   TypesSupported	REG_DWORD	0x00000007
   EventMessageFile	REG_SZ	Full path of rw-eventlogmessages.dll Eg.: C:\filter\rw-eventlogmessages.dll

    
4. Restart Event Viewer

 

Event ID Table

 

Category	Level	Event ID	Parameters	Description
Agent	Information	256	Title, Base	Agent started with success.
Agent	Information	257	Title, Base	Agent terminated with success.
Agent	Information	258	Title, Event URL, State configuration, State rules, State watermark, State block paste, Base	Agent contacted web service for user configuration check/update with success.
Agent	Information	259	Title, Log count, Event URL, Base	Agent sent user LOG to web service with success.
Agent	Error	260	Title, Base	Agent failed to start.
Agent	Error	261	Title, Event URL, HTTP error code, Base	Agent could not check/update user configuration.
Agent	Error	262	Title, Event URL, HTTP error code, Base	Agent failed to send user LOG to web service.
Application	Information	263	Title, Module name, Process ID, Application path, Base	Application started with success.
Application	Information	264	Title, Module name, Process ID, Application path, Base	Application terminated with success.
Application	Error	265	Title, Module name, Base	Application did not start with success.
AddIn	Information	272	Title, Module name, Process ID, Application path, Base	AddIn started with success.
AddIn	Information	273	Title, Module name, Process ID, Application path, Base	AddIn terminated with success.
AddIn	Error	274	Title, Module name, Process ID, Application path, Base	AddIn did not start with success.

 

 

Custom Event IDs

Category	Level	Event ID
Agent	Information	275
Agent	Warning	276
Agent	Error	277
Application	Information	275
Application	Warning	276
Application	Error	277
AddIn	Information	275
AddIn	Warning	276
AddIn	Error	277