Winlogbeat 7.9 removed a field?

Elastic Stack Beats
1

I just completed upgrading my winlogbeat versions to 7.9.1. As part of this upgrade it now appears that my winlogbeat agent is no longer parsing this particular event type?

image
image936×44 5.96 KB

This event type is part a sysmon job that is tied to the Mitre Attack Framework and is part of our monitoring dashboard.

Any thoughts on how to get this back without reverting to a lower version?

2

Since v7.8.0 it's been using the ECS rule.name field for this data.


3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.