Winlogbeat - Sysmon Module and Even.Code: 1 Missing

Elastic Stack Beats
,
1

I am having a problem with Winlogbeats not sending or not properly parsing all the Sysmon event.code fields. I have been testing beign able to event code: 1 for process creations like "whoami.exe", but when I started to look I did not see any event code=1 being sent. I can look in the Event viewer and see them listed, but for some reason I do not see it in Kibana. I am not dropping any event codes on any server, but some workstations I am I am dropping event.code: 2 AND 3....

Any ideas on why that is?

Event Log:

image
image664×572 10.7 KB

Detailed Event Log:

image
image1034×610 14.4 KB

Graph in Kibana: (7 days)

image
image1089×323 29 KB

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.