WinEvent Instance

Name. The name of the monitor as it appears in the Passive Monitor Library.
Description. The description of the monitor as it appears in the Passive Monitor Library.
Condition. This is a list of conditions to match. Only log entries which match these expressions will be converted to events. Conditions are processed serially from top to bottom. As each condition is evaluated, its results are applied to the next condition until all conditions have been evaluated. For complex sets of conditions involving both ANDs and ORs, this serial logic may produce different results than intended. As a best practice, we recommend keeping conditions simple by opting for multiple Passive Monitors over complex sets of conditions. When complex conditions are unavoidable, we recommend grouping all OR conditions together at the beginning of the set of conditions, followed by the ANDs.
Click Edit condition to add or edit a condition or Clear condition to remove it from the box.
Match Description On. You can click the Add button and this will take you to the Expression Editor where you can create your expression, test it, and compare it against potential payloads you can receive. After creating the expression, clicking OK will insert that string into the Match Description On list.
Note: If you have multiple payload Match Description On expressions, they are linked by OR logic, not AND logic. For example, if you have two expressions, one set to "AB" and the other to "BA", it will match against any log entry that includes either of the two strings.