Hi!
By the way, we have two days of reading windows event log - one is agent log parser (set up in policy in template that is applied to agent) and the second is windows event log synchronization. Which one you are using? Anyways, both of these ways should work similarly on the following:
When netxms event is created, additional information from windows event should be added as parameters:
https://www.netxms.org/documentation/adminguide/log-monitoring.html#passing-parameters-to-events
If you your Teams_Alarm_AD_Anmeldung event in netxms event log and double-click it, you should see detailed information about the event, including values of it's parameters. Is the information you need present in these parameters?
