I'm new here and I am trying to set up a Windows centralised log for the first time with ELK. So far, everything is working out for me.
I want to make a visualisation in Kibana to view succesful account logons on the Windows domain. It's working fine, but i'm seeing duplicate account names when I split rows on event_data.TargetUserName. These usernames are the same, but the spelling is different.
Example: I want to see in the table how many times a user has succesfully loged on, how many different computers and how many unique IP Addresses the user has 'used'. This is one of the data tables given as a template with Winlogbeat.
But I get multiple rows for the same usernames, with different spelling. Eg I see a row with user "Bob", but also a row for user "bob", which is the same account. The person just spelled his username with lower case characters on the logon screen.
Any idea on how to filter these duplicates out? Or do I need to change this (I don't know how) on the Windows side? Maybe there is a way to always force a user to log in with lower/upper case characters only?
Thanks in advance,