# SIEM Search Expressions and Windows Event Logs

**URL:** <https://forums.cybrary.it/t/siem-search-expressions-and-windows-event-logs/566936>\
**Category:** Career Paths\
**Created:** [August 4, 2025, 4:42pm UTC](https://forums.cybrary.it/t/siem-search-expressions-and-windows-event-logs/566936 "2025-08-04T16:42:03Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![CreativeWombat1557](https://forums.cybrary.it/user_avatar/forums.cybrary.it/creativewombat1557/32/11_2.png) [@CreativeWombat1557](https://forums.cybrary.it/u/CreativeWombat1557)\
**Post date:** [August 4, 2025, 4:42pm UTC](https://forums.cybrary.it/t/siem-search-expressions-and-windows-event-logs/566936/1 "2025-08-04T16:42:03Z")

</div>

Hi All,

I got an problem open the lab. When you launch the lab its open the Windows michine.

---

<div class="post-metadata">

**Author:** ![CalmQuail2332](https://forums.cybrary.it/user_avatar/forums.cybrary.it/calmquail2332/32/33622_2.png) [@CalmQuail2332](https://forums.cybrary.it/u/CalmQuail2332)\
**Post date:** [August 4, 2025, 5:24pm UTC](https://forums.cybrary.it/t/siem-search-expressions-and-windows-event-logs/566936/2 "2025-08-04T17:24:22Z")

</div>

Yes, that’s normal behavior. The first step in the instructions is to switch to the Wazuh machine using the Machines tab.

---

<div class="post-metadata">

**Author:** ![CalmQuail2332](https://forums.cybrary.it/user_avatar/forums.cybrary.it/calmquail2332/32/33622_2.png) [@CalmQuail2332](https://forums.cybrary.it/u/CalmQuail2332)\
**Post date:** [August 4, 2025, 5:25pm UTC](https://forums.cybrary.it/t/siem-search-expressions-and-windows-event-logs/566936/3 "2025-08-04T17:25:58Z")

</div>

The lab is still loading in this screenshot, but once it has finished you can click the Wazuh tile to connect to that machine.

 ![Screenshot 2025-08-04 at 1.25.03 PM](https://forums.cybrary.it/uploads/default/original/3X/3/f/3f88d055db969df129a5167e186a7b6dffb2c03c.png)

---

<div class="post-metadata">

**Author:** ![CreativeWombat1557](https://forums.cybrary.it/user_avatar/forums.cybrary.it/creativewombat1557/32/11_2.png) [@CreativeWombat1557](https://forums.cybrary.it/u/CreativeWombat1557)\
**Post date:** [August 6, 2025, 11:52am UTC](https://forums.cybrary.it/t/siem-search-expressions-and-windows-event-logs/566936/4 "2025-08-06T11:52:02Z")

</div>

Thank you very much. What i realized is the there are no machine tab on both Exercese guide.

---

<div class="post-metadata">

**Author:** ![CreativeWombat1557](https://forums.cybrary.it/user_avatar/forums.cybrary.it/creativewombat1557/32/11_2.png) [@CreativeWombat1557](https://forums.cybrary.it/u/CreativeWombat1557)\
**Post date:** [August 6, 2025, 11:54am UTC](https://forums.cybrary.it/t/siem-search-expressions-and-windows-event-logs/566936/5 "2025-08-06T11:54:10Z")

</div>

![imagem](https://forums.cybrary.it/uploads/default/original/3X/0/e/0ee4b6b14f2311586515d2dc3d41bc03c914b65d.png)

---

<div class="post-metadata">

**Author:** ![CalmQuail2332](https://forums.cybrary.it/user_avatar/forums.cybrary.it/calmquail2332/32/33622_2.png) [@CalmQuail2332](https://forums.cybrary.it/u/CalmQuail2332)\
**Post date:** [August 6, 2025, 1:40pm UTC](https://forums.cybrary.it/t/siem-search-expressions-and-windows-event-logs/566936/6 "2025-08-06T13:40:00Z")

</div>

The Machines tab will not appear until you click Start Lab.

 ![Screenshot 2025-08-06 at 9.39.38 AM](https://forums.cybrary.it/uploads/default/original/3X/f/d/fd7351067598c5ee467037ecb8e2ed0408e1168f.png)

---

<div class="post-metadata">

**Author:** ![CreativeWombat1557](https://forums.cybrary.it/user_avatar/forums.cybrary.it/creativewombat1557/32/11_2.png) [@CreativeWombat1557](https://forums.cybrary.it/u/CreativeWombat1557)\
**Post date:** [August 6, 2025, 4:20pm UTC](https://forums.cybrary.it/t/siem-search-expressions-and-windows-event-logs/566936/7 "2025-08-06T16:20:19Z")

</div>

Thank you. Was my distraction