Elastic Agent/Fleet - Winlog input missing security events

Elastic Stack Elasticsearch
1

Hey all

I'm working on deploying a Elastic stac POC but have hit a strange issue with collecting windows security event logs

Environment

  • Elasticsearch/Kibana/Fleet Server: 9.5.1

  • Tested Elastic Agent: 9.5.1 and 9.4.2

  • Windows Server 2019 domain controller

  • Agent installed as a Windows service running as NT AUTHORITY\SYSTEM

  • Fleet System integration has Application, Security and System enabled

  • Other Windows Event Logs are ingesting correctly (Application, System, PowerShell, Directory Service, DNS Server, Defender, etc.)

The problem is specifically i'm not seeing any "Security" event log data.

Running the following discover, I get no data

host.name : "SERVERNAME" and data_stream.dataset : "system.security"

I can confirm there are security event

Get-WinEvent -LogName Security -MaxEvents 10

Fleet senders the stream correct and elastic agent seems to be working

Starting to read from Security
Reading from Security
windows event log opened successfully

I've tested this on a couple of machine's which have similar outcomes, missing security events. standalone WinLogBeat works on the same server with a simple config

winlogbeat.event_logs:

  • id: security-test
    xml_query: >

But this doesn't work

winlogbeat.event_logs:

  • name: Security

Any suggestions where to go from here?

2

Do you have data if you use the following query?

data_stream.dataset : "system.security"  and host.os.platform : "windows"