Windows applications that create Windows event reports are called Windows event sources. Each event source creates its own set of events with an associated event type and event identifier. Event types correspond to the severity of the event (Error, Warning, Information, Success Audit, Failure Audit). Event identifiers are unique within a given event source and severity.
To add an event source to the current filter policy
In the Windows Filter Policy window, click Add Source on the Edit menu. The Add Source dialog box appears.
Enter the name of a new event source in the Selection field.
Click Create.