Where can I see alll Winlogbeat Event ID definitions?

Elastic Stack Beats
1

Does anyone know where the winlogbeat event ID's are at?

I have winlogbet_even_id = 600

But I would also like to know where I can see all of them as a knowledgebase?

2

Winlogbeat does not have any knowledge about the event ID definitions. All of the event IDs are defined by Windows or by the applications that log the events. Winlogbeat receives all the event data from APIs within Windows.

Windows itself can provide information about the event publishers. See wevtutil. For example:

wevtutil gp Microsoft-Windows-Eventlog /ge:true

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.