Hello everyone !
I'm having weird issue with winlogbeat.
When I use winlogbeat on Windows 10, after I create a windows user it uses fields such as "process.name", "process.parent.args" etc.
But when I create a user on Windows Server 2019 it never uses these field. Also I don't even receive any "process create/terminate event"
Unfortunately I can't use Detection Rules since these fields does not exists.
Any one knows why ?
Some of the fields that windows 10 has while server 2019 doesn't.
