It will all start with a search. I don’t quite know what Applocker events show up as in the logs, but if you do a full text search for “applocker” against your AgentX logs, hopefully there is something that you can identify - either certain labels, or perhaps the event-source field. You can limit your search to AgentX log by using norm_id=AgentX, or of course by just selecting the correct repository.

And then it is a question as to what you actually want to visualise - usually it’d be something like

norm_id=AgentX event_source=Microsoft-Windows-AppLocker |chart count() by message

or action, or account, or whatever fields you see in your AppLocker logs.

Once you have the right query, you can add it do a new dashboard widgets from the dropdown in the top right of the Search interface.

First of all thank you so much for the help.

Oddly the event_source Windows applocker doesnt pop up at all.
So I told Agent X to report on certain windows event like

The ones in this list in the event ID list.
is there anything else that needs to be done that I missed for it to collect these logs?

As long as the log is coming from a Windows Event Log, there should be an event_source field. I took the example from our demo system, and there the event_source field was present for an Applocker event - but it’s possible something has changed/broken.

I would suggest opening a Support ticket, and supplying the raw log(s) and how it gets normalised - ideally, all of your events should be labelled too, so that you don’t need to map anything manually like you did. I suppose there weren’t any useful labels either?