What log Windows security rules require into a winlogbeat

Elastic Stack Kibana
1

I want to enable most of the Windows security rules in Kibana, but I am missing a lot of fields from my winlogbeat. We are fowarding our logs into a windows event collector but I don't know what log are missing for the security rules.

Exemple:

  • Microsoft-Windows-PowerShell/Operational
  • Microsoft-Windows-PowerShell/Admin

I don't want to install the agent on every server, we already have too many agent running.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.