By default, Windows Client uses the Windows logon event. However, in some scenarios you must create a separate event. For example, when the predefined event is used for domain joined workstations, you can create a custom event with type Generic for the non-domain joined workstations. In this case you will need to point these non-domain workstations to the custom event using the following parameter in the event_name: <CustomEventName> configuration file:
C:\ProgramData\NetIQ\Windows Client\config.properties