Dear Thwack-Community!
I do have a question about the Windows event log monitor.
In a simple scenario you look for a specific even ID in - let's say - the security event log.
If there is a match, it will turn up in the component as critical, or whatever you define. Now, after some time passes, the event will disappear, because the monitor only checks the most recent events instead of going through the whole log every time.
In most cases this is fine. But is there a possibility to control the duration of how long this event will show up as anomaly or even better, is there a way to keep it as long as it is in the current event log?
Thank you in advance for your help!
-FRA