you can setup an alarm for each Signatur ID in SIEM that indicates this is a Windows 2003 Server.
43-211#####0 for a Event from a 2003 Server and the #### indicates the EventID from Eventlog. But i think this is a to heavy Alarmsetting.
Thak you for the detail. Is there list for all Windows 2003 events?
Yes and No, becaus there are lists but not complete.
And the list in the Database of the SIEM =)
Where do i find list from MacAfee for each OS type?
There is no list
Use "device type" and chose all McAfee devices that would inlcude all Mcafee OS and appliances.