Running an Elastic Stack version 8 server. Trying to get Winlogbeat to send events to the server and run some detection rules alerts on them, but not getting all the expected fields configured.
E.g. one of the rules monitors registry changes and is looking for both winlog.event_data.Details and registry.path fields, which I understand should be part of the ECS Windows mappings:
I’ve tried:
a) Enabling auditing for the registry, and get 4657 events generated in the event log and these get shipped to Logstash (also tried shipping directly to ES). They appear to get some ECS mapping (e.g. ecs.version = 8.0.0, event.code = 4657) but neither of the fields expected by the detection rule is populated.
b) Installing sysmon and shipping those events there’s a little bit of progress. The winlog.event_data.Details is populated, but not the registry.
There’s a datastream in the stack management and it’s using a winlogbeat mapping.
I’m a bit stumped as to what we’re missing.