Hi
Not sure really , the auditor in me says I need this event. The realistic side of me says it really depends on the frequency.
This is sort of related - and leads to this being an application by application basis issue
https://support.microsoft.com/en-gb/kb/2859188
Is there a way to not "read" that data and just send it through raw anyway, so that if needed we still have it in elastic search?
Thanks