When Winlogbeat ingest data from a domain controller it uses the GUID from GPO. I wanted to see if there was a way to create a new field within the index that would translate the GUID to the actual GPO name. I've looked at creating a list that is pulled in on a schedule and then updates the new field as a runtime field, but I feel like there has to be an easier way to do this. Has anyone solved this before or does anyone have any ideas how I could get after this myself?
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.