By default Windows logon event is used. However, in some cases it is required to create a separate event. For example, when the predefined event is used for domain joined workstations, you can create a custom event with type Generic for the non-domain joined workstations. In this case you will need to point these [non-domain] workstations to the custom event using the following parameter in the event_name: <CustomEventName> configuration file:
C:\ProgramData\NetIQ\Windows Client\config.properties
NOTE:Caching is not supported for the custom events.