Winlogbeat Evt 4741 4742 4743 - Computer Management Events

I'm working now with Events related to creation, changing and deletion of computers in windows Active directory.

In these events the fields TargetUserSID, TargetUserName and TargetDomainName represents the SID,Name and Domain of the computer (object) being created, modified or deleted.

When I analyze the events I thought that mapping these fields to ECS, and host.domain ( was a the way to go.
But then I realize that the host.* fields are used and mapped in all the other cases with the source host of the events and therefore is not a good idea to use the host.* fields in this case.

Should be better to use an specific winlog fields?
For example:, and

What do you think?
Thank you

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.