This does not work:

<QueryList>
<Query Id="0" Path="AD FS/Admin">
<Select Path="AD FS/Admin">*</Select>
</Query>
</QueryList>

This does not work:

<QueryList>
<Query Id="0" Path="AD FS/Admin">
<Select Path="AD FS/Admin">*</Select>
</Query>
</QueryList>

Hi,

Do you have a working one? I need the exact same query :)

Thanks
L:

This does not work:

<QueryList>
<Query Id="0" Path="AD FS/Admin">
<Select Path="AD FS/Admin">*</Select>
</Query>
</QueryList>

Hi,

Do you have a working one? I need the exact same query :)

Thanks
L:

This does not work:

<QueryList>
<Query Id="0" Path="AD FS/Admin">
<Select Path="AD FS/Admin">*</Select>
</Query>
</QueryList>

Hi,

Do you have a working one? I need the exact same query :)

Thanks
L:

This does not work:

<QueryList>
<Query Id="0" Path="AD FS/Admin">
<Select Path="AD FS/Admin">*</Select>
</Query>
</QueryList>

https://social.technet.microsoft.com/Forums/windowsserver/en-US/d3feeeac-bbc9-4acd-a382-5d6bd92112a5/adfs-wap-and-logging

 Thanks anyway
Laszlo

------------------------------
Laszlo Pal
------------------------------


Original Message:
Sent: Wed March 04, 2020 08:49 AM
From: Vedran Goricki
Subject: Please, help to write XPATH to AD FS/Admin

Hi 
Sorry don't have AD FS 

I can put example for DNS Server

On the last pic You get exact path which You need to Copy to Log Source.
On Log Activity Tab check Log Source from that Log Source Event name - unknown there is possibility that Logs are not parsed  
I know i did the same thing for TerminalService-RemoteConnectionManager Logs from Windows and Logs are getting Event name Unknown. Qradar does not know that events.
If You have the agent installed on that server You can do restart service. Check the wincollect.log if there is Query open for the AD FS or there is an error. If You using User and pass check for access denied errors 

My Example for terminal connections from wincollect.log:

 Created new query 1: <QueryList><Query Id="1" Path="Security"><Select Path="Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational">*[System[(Level=4 or Level=0) and (EventID=1149)]] </Select></Query></QueryList>

Hope it helps

Regards

Vedran

------------------------------
Vedran Goricki


Original Message:
Sent: Wed March 04, 2020 08:13 AM
From: Laszlo Pal
Subject: Please, help to write XPATH to AD FS/Admin

Hi,

Do you have a working one? I need the exact same query :)

Thanks
L:

------------------------------
Laszlo Pal


Original Message:
Sent: Tue December 10, 2019 03:33 AM
From: Vadim Novikov
Subject: Please, help to write XPATH to AD FS/Admin

This does not work:

<QueryList>
<Query Id="0" Path="AD FS/Admin">
<Select Path="AD FS/Admin">*</Select>
</Query>
</QueryList>

------------------------------
Vadim Novikov
SOC Engineer
IT-Specialist
Kiev
+380972970792