Event Log rule not firing even though events are being written to the Event log table
Dashboard| Administration| Agents| Agent Status| Windows_System Agent Property
In the Event Log Filter, there may be a global exclusion in place before the inclusion (intended alert).
Dashboard| Administration| Agents| Agent Status| Windows_System Agent Property
Be sure to place all Inclusions above the Exclusions in the Event Log Filter's Include/Exclude list.
Any Inclusions added after the Exclusions will be ignored.
In cases were the events are not being written to the Event Log table, check the agent properties.
Verify if "Collect log events" is set to True
