KBI 310950 New Feature: Fire Event Log Alerts With Combined Messages In Detail


Argent for Compliance 3.1A-1404-T3 or earlier


Wednesday, 4 June 2014


Argent for Compliance has always been able to combine Alerts into a single Alert for Event Logs

See KBI 310512 Combining Alerts Into A Single Alert For Event Logs in Argent AT

Though the Combined Events have the same Event ID and Event Source, the message detail might be slightly different

Customer may need to see the difference to identify what the Alert is actually is about

For example, Rule EVT_TEST checks file share access Event 5140

If the default option of ‘Combine Events With Latest Description‘ is used, the Alert message will miss the different share name and path for the combined Events

The TEST result will look like following:

If the option ‘Combine Events With Full Description‘ is used, the Alert message will be more in detail

Argent for Compliance also provides the user-friendly interface to change the system default without editing registry as described in KBI 310512

Technical Background



Upgrade to Argent Advanced Technology 3.1A-1404-T3 or later