Drop event in procesor result in no records

Elastic Stack Elastic Agent
1

I am using Fleet to configure agent policies for windows servers.
I configure to get several security events 4624, 4625, 4771 and drop events when LogonType = 3

I ve configure procesor like this:

  • drop_event:
    when:
    equals:
    winlog.event_data.LogonType: 3

The result is no security channel events are ingested in Elasticsearch.

2

Hi,

Try changing your condition to compare winlog.event_data.LogonType to the string "3" instead:

drop_event:
  when:
    equals:
      winlog.event_data.LogonType: "3"

Regards

3

Thanks!
Thats resolve the problem

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.