# Elastic SIEM No Failed Authentications **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [May 6, 2020, 1:16pm UTC](https://discuss.elastic.co/t/elastic-siem-no-failed-authentications/231344 "2020-05-06T13:16:21Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![wilfyboyGG](https://avatars.discourse-cdn.com/v4/letter/w/94ad74/32.png) [@wilfyboyGG](https://discuss.elastic.co/u/wilfyboyGG)\ **Post date:** [May 6, 2020, 1:16pm UTC](https://discuss.elastic.co/t/elastic-siem-no-failed-authentications/231344/1 "2020-05-06T13:16:21Z")
Hello Community! I'm Exploring ELK as a SIEM. As a beginner I have Winlogbea installed on a virtual machine that's subscribed to forwarded events from Domain Controller. I've made subsequent changes to the YML file and I'm receiving the logs within elastic. \*\* ISSUE: 0 FAILED AUTHENTICATION \*\* Please view the attached image and let me know if have to make changes in GPO or YML file to get failed logs. ![winlogbeat i9ssue](https://us1.discourse-cdn.com/elastic/original/3X/7/e/7e986ccaa235ec04fb5c34a5470abe04b851dbb7.png) ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [May 7, 2020, 2:27pm UTC](https://discuss.elastic.co/t/elastic-siem-no-failed-authentications/231344/2 "2020-05-07T14:27:15Z")
See [https://www.elastic.co/guide/en/beats/winlogbeat/7.6/winlogbeat-modules.html#\_usage\_with\_forwarded\_events](https://www.elastic.co/guide/en/beats/winlogbeat/7.6/winlogbeat-modules.html#_usage_with_forwarded_events). In 7.8 we will include this as part of the default config file. ---
**Author:** ![wilfyboyGG](https://avatars.discourse-cdn.com/v4/letter/w/94ad74/32.png) [@wilfyboyGG](https://discuss.elastic.co/u/wilfyboyGG)\ **Post date:** [May 7, 2020, 3:38pm UTC](https://discuss.elastic.co/t/elastic-siem-no-failed-authentications/231344/3 "2020-05-07T15:38:45Z")
Hi Andrew, Thank you for your reply! When I add the following lines to the YML File. the Winlogbeat service won't start. I'm I doing something wrong ? ````auto - name: ForwardedEvents tags: [forwarded] processors: - script: when.equals.winlog.channel: Security lang: javascript id: security file: ${path.home}/module/security/config/winlogbeat-security.js - script: when.equals.winlog.channel: Microsoft-Windows-Sysmon/Operational lang: javascript id: sysmon file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js``` ```` ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [May 7, 2020, 3:55pm UTC](https://discuss.elastic.co/t/elastic-siem-no-failed-authentications/231344/4 "2020-05-07T15:55:51Z")
Are those three backticks ``` part of your file? Can you run `.\winlogbeat.exe test config` and `.\winlogbeat export config` and see if you notice any issues. ---
**Author:** ![wilfyboyGG](https://avatars.discourse-cdn.com/v4/letter/w/94ad74/32.png) [@wilfyboyGG](https://discuss.elastic.co/u/wilfyboyGG)\ **Post date:** [May 7, 2020, 7:33pm UTC](https://discuss.elastic.co/t/elastic-siem-no-failed-authentications/231344/5 "2020-05-07T19:33:20Z")
> [@andrewkroh](#): > > inlogbeat export confi No those backticks aren't part of my file. thanks for asking Also this is Error what I get after running command `.\winlogbeat export config` `PS C:\Program Files\Winlogbeat> .\winlogbeat export config 2020-05-07 15:18:02.6331736 -0400 EDT m=+0.060222701 write error: failed to rotate backups: failed to rotate backups: re name C:\Program Files\Winlogbeat\logs\winlogbeat.1 C:\Program Files\Winlogbeat\logs\winlogbeat.2: Access is denied. 2020-05-07 15:18:02.6411611 -0400 EDT m=+0.068210001 write error: failed to rotate backups: failed to rotate backups: re name C:\Program Files\Winlogbeat\logs\winlogbeat.1 C:\Program Files\Winlogbeat\logs\winlogbeat.2: Access is denied.` ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [May 7, 2020, 8:16pm UTC](https://discuss.elastic.co/t/elastic-siem-no-failed-authentications/231344/6 "2020-05-07T20:16:07Z")
Maybe you weren't running as an administrator? If you add a `-e` it should log to stderr and avoid that issue. ---
**Author:** ![wilfyboyGG](https://avatars.discourse-cdn.com/v4/letter/w/94ad74/32.png) [@wilfyboyGG](https://discuss.elastic.co/u/wilfyboyGG)\ **Post date:** [May 14, 2020, 1:42pm UTC](https://discuss.elastic.co/t/elastic-siem-no-failed-authentications/231344/7 "2020-05-14T13:42:00Z")
Hi Andrew, The test config came ok. But still not getting failed authentications in SIEM, while in discover tab I was able to find different failed logon events. I've created a work around to visualize failed auths in dashboards until I figure out how to get failed authentication on elastic SIEM. Thanks, Wilfred ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 11, 2020, 1:42pm UTC](https://discuss.elastic.co/t/elastic-siem-no-failed-authentications/231344/8 "2020-06-11T13:42:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.