Log on workstation hostname

Elastic Stack Beats
1

I am using ELK 7.12.1 mainly to log AD events at the minute. I have had a device go missing and I want to track down the last time it was logged on. I have been using user.name.text to locate user logons but I don't think the workstation name gets logged.

How can I log the workstation name for when a user logs on?

2

Are you using Winlogbeat?

3

I have Winlogbeat running on all my DC's this provide a phenomenal amount of data via the 'Winlogbeat Security - User Management Events'

I am just missing the workstation ID. This may not get collected via AD logs hence not showing up in ELK but it would be really helpful to get this in.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.