Hello everyone, I want to have control of log events using Winlogbeat with parsing event with id 4663, winlog.event_data.AccessMask's and winlog.event_data.AccessList's winlog.event_data.AccessMask: "0x10000" winlog.event_data.AccessMask: "0x20" winlog.event_data.AccessMask: "0x4" winlog.event_…

Winlogbeat winlog.event_data.AccessList process

system (system) Closed August 6, 2021, 8:49pm 2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Winlogbeat filter Beats winlogbeat	2	1026	August 16, 2018
Winlogbeat not all events are parsed Beats winlogbeat	2	863	April 26, 2019
Adding to security module the parse of event.id equals to 4663 Beats winlogbeat	3	1103	June 5, 2020
Filter :Active Directory Event Beats winlogbeat	8	829	June 7, 2018
Winlogbeat v5 - Message not read fully Beats winlogbeat	10	4508	June 21, 2016

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Winlogbeat winlog.event_data.AccessList process

Related topics