Winlogbeat not writing all events to Elasticsearch

Elastic Stack Elasticsearch
1

Hello,

I'm using the Elastic Stack version 7.8.0 ( Winlogbeat -> Elasticsearch pipeline) in Windows 10 Operating System .

Issue : Winlogbeat not capturing all the events generated in Windows Machine. For eg: (Audit trial logs cleared, Failed Login attempts etc. ) events are not getting indexed to Elasticsearch.

But I can see few other event data indexed to Elasticsearch.

Please help me, whether I'm missing any additional configuration required to capture those events.

Thanks in Advance.

2

Hi @mozam Did you remember to deploy the Sysmon module, see Sysmon before starting Winlogbeat? If you compare to Auditbeat on Linux, Winlogbeat may not expose all required functionality yet, I belive.

3

Hi @fgjensen Thanks for the quick reply.

No I haven't, let me check.