Help with creating a trigger on a Windows event log Critical log event

[greavette]

Hello,

I'm using Zabbix 6.0 and I've created a simple template that pulls in my Windows System Logs from Event Viewer. The template is working and when Viewing Latest Data the History shows me all events pulled into my Zabbix.

I would like to create a trigger for any System event that is listed as Critical. I don't have any specific System event but would like to alert on any Critical Event. How would I build my new Trigger in this template provide the dashboard alert I'd like to see.

Thank you.

[cyber]

https://www.zabbix.com/documentation/6.0/en/manual/appendix/functions/history

logseverity (/host/key,<#num<:time shift>>)
Log severity of the last log entry.	See common parameters. #num (optional) - the Nth most recent value	Supported value types: log Returns: 0 - default severity N - severity (integer, useful for Windows event logs: 1 - Information, 2 - Warning, 4 - Error, 7 - Failure Audit, 8 - Success Audit, 9 - Critical, 10 - Verbose). Zabbix takes log severity from Information field of Windows event log.

[cyber]

https://www.zabbix.com/documentation/6.0/en/manual/appendix/functions/history

logseverity (/host/key,<#num<:time shift>>)
Log severity of the last log entry.	See common parameters. #num (optional) - the Nth most recent value	Supported value types: log Returns: 0 - default severity N - severity (integer, useful for Windows event logs: 1 - Information, 2 - Warning, 4 - Error, 7 - Failure Audit, 8 - Success Audit, 9 - Critical, 10 - Verbose). Zabbix takes log severity from Information field of Windows event log.

[mzeman81]

Is possible to bind it with 3 or more consecutive Windows failed logons?