Tracing which privileged user used a local admin account in windows

Elastic Stack Beats
1

Hi All,

Reaching out to the community to seek a response to find which privileged user has used a local admin account on a windows server from Kibana, can anyone suggest ?

Regards,

2

Hey Manas,
I'm not sure I follow the question.

Are you talking about viewing how a user is using Kibana itself?
Or are you talking about tracing a user through our Security Solution?
If this is Security Solution related, then you'll likely have more luck in their discuss forum.

Or perhaps something else? :grimacing:
Any clarification could help figure out who can help you out.

1 Like
3

Hi @gmmorris, thanks for the response. Yes I'm referring to discuss forum 1 but with winlogbeats logs. Regards,

4

Ah, I see, in that case it belongs in Beats - Discuss the Elastic Stack :slight_smile:
I'll move the question over there.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.