From c9f2187d54ecbd05099b7f958b8724aee7208cb0 Mon Sep 17 00:00:00 2001 From: Michael Wenthold Date: Tue, 6 May 2025 15:21:54 -0400 Subject: [PATCH] Updated Windows Pack doc Added items for message reduction, event original retention --- ...dows Security Event Logs Content Pack.html | 2983 +++++++++-------- 1 file changed, 1518 insertions(+), 1465 deletions(-) diff --git a/Content/Content Packs/Windows Security Event Logs Content Pack.html b/Content/Content Packs/Windows Security Event Logs Content Pack.html index d3886989..5b8a263f 100644 --- a/Content/Content Packs/Windows Security Event Logs Content Pack.html +++ b/Content/Content Packs/Windows Security Event Logs Content Pack.html @@ -9,7 +9,7 @@ @@ -45,12 +45,26 @@

Index Set Configuration

If these index sets are already defined, then nothing will be changed. If these index sets do not exist, then they will be created with retention settings of a daily rotation and 90 days of retention. These settings can be adjusted as required after installation.

What is Provided

Events Processed by This Technology Pack

-

Illuminate will perform some basic processing of all event logs ingested by Winlogbeat, normalizing field common to all events:

+

Illuminate will perform some basic processing of all event logs ingested by Winlogbeat/NXlog, normalizing the following fields common to all events:

@@ -93,1465 +107,1504 @@

Events Processed by This Technology Pack

-

 

-

The Windows Security technology pack will apply normalization of common event log fields, such as Event ID, to all Windows event log messages. The Windows Security technology pack will provide normalization and enrichment to the following Windows security event log IDs:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-

Event ID

- 		-

Additional Data

- 		-

gim_event_type_code

- 		-

gim_event_category

- 		-

gim_event_subcategory

- 		-

gim_event_type

-
-

1100

- 		-

 

- 		-

220101

- 		-

audit

- 		-

audit.state

- 		-

audit service stopped

-
-

1101

- 		-

 

- 		-

220102

- 		-

audit

- 		-

audit.state

- 		-

audit error

-
-

1102

- 		-

 

- 		-

220000

- 		-

audit

- 		-

audit.integrity

- 		-

audit log cleared

-
-

1104

- 		-

 

- 		-

220102

- 		-

audit

- 		-

audit.state

- 		-

audit error

-
-

4610

- 		-

 

- 		-

270000

- 		-

registry

- 		-

registry.default

- 		-

registry event

-
-

4611

- 		-

 

- 		-

270000

- 		-

registry

- 		-

registry.default

- 		-

registry event

-
-

4614

- 		-

 

- 		-

270000

- 		-

registry

- 		-

registry.default

- 		-

registry event

-
-

4616

- 		-

 

- 		-

260000

- 		-

registry

- 		-

registry.default

- 		-

registry event

-
-

4622

- 		-

 

- 		-

270000

- 		-

registry

- 		-

registry.default

- 		-

registry event

-
-

4624

- 		-

 

- 		-

100000

- 		-

authentication

- 		-

authentication.logon

- 		-

logon

-
-

4625

- 		-

 

- 		-

100000

- 		-

authentication

- 		-

authentication.logon

- 		-

logon

-
-

4634

- 		-

 

- 		-

102500

- 		-

authentication

- 		-

authentication.logoff

- 		-

logoff

-
-

4647

- 		-

 

- 		-

102500

- 		-

authentication

- 		-

authentication.logoff

- 		-

logoff

-
-

4648

- 		-

 

- 		-

100003

- 		-

authentication

- 		-

authentication.logon

- 		-

logon with alternate credentials

-
-

4663

- 		-

Access Type: ReadEA

- 		-

209999

- 		-

file

- 		-

file.default

- 		-

file event

-
-

4663

- 		-

Access Type: ReadData (or ListDirectory)

- 		-

201500

- 		-

file

- 		-

file.access

- 		-

file access

-
-

4663

- 		-

Access Type: WriteData (or AddFile)

- 		-

201000

- 		-

file

- 		-

file.modify

- 		-

file modified

-
-

4663

- 		-

Access Type: AppendData (or AddSubdirectory or CreatePipeInstance)

- 		-

201000

- 		-

file

- 		-

file.modify

- 		-

file modified

-
-

4663

- 		-

Access Type: Notify about changes to keys

- 		-

259999

- 		-

registry

- 		-

registry.default

- 		-

registry event

-
-

4663

- 		-

Access Type: Enumerate sub-key

- 		-

259999

- 		-

registry

- 		-

registry.default

- 		-

registry event

-
-

4663

- 		-

Access Type: Create sub-key

- 		-

250500

- 		-

registry

- 		-

registry.key_change

- 		-

registry key added

-
-

4663

- 		-

Access Type: Set key value

- 		-

250000

- 		-

registry

- 		-

registry.value_change

- 		-

registry value set

-
-

4663

- 		-

Access Type: Query key value

- 		-

259999

- 		-

registry

- 		-

registry.default

- 		-

registry event

-
-

4663

- 		-

Access Type: WriteEA

- 		-

209999

- 		-

file

- 		-

file.default

- 		-

file event

-
-

4672

- 		-

 

- 		-

101000

- 		-

authentication

- 		-

authentication.access notice

- 		-

special logon

-
-

4688

- 		-

 

- 		-

190000

- 		-

process

- 		-

process.execution

- 		-

process started

-
-

4689

- 		-

 

- 		-

190100

- 		-

process

- 		-

process.end

- 		-

process stopped

-
-

4697

- 		-

 

- 		-

211500

- 		-

service

- 		-

service.state

- 		-

service installed

-
-

4720

- 		-

 

- 		-

110000

- 		-

iam

- 		-

iam.object create

- 		-

account created

-
-

4722

- 		-

 

- 		-

112001

- 		-

iam

- 		-

iam.object enable

- 		-

account enabled

-
-

4723

- 		-

 

- 		-

111004

- 		-

iam

- 		-

iam.object modify

- 		-

password change

-
-

4724

- 		-

 

- 		-

111005

- 		-

iam

- 		-

iam.object modify

- 		-

administrative password reset

-
-

4725

- 		-

 

- 		-

111501

- 		-

iam

- 		-

iam.object disable

- 		-

account disabled

-
-

4726

- 		-

 

- 		-

110500

- 		-

iam

- 		-

iam.object delete

- 		-

account deleted

-
-

4727

- 		-

 

- 		-

110002

- 		-

iam

- 		-

iam.object create

- 		-

group created

-
-

4728

- 		-

 

- 		-

111007

- 		-

iam

- 		-

iam.object modify

- 		-

group member added

-
-

4729

- 		-

 

- 		-

111008

- 		-

iam

- 		-

iam.object modify

- 		-

group member removed

-
-

4730

- 		-

 

- 		-

110501

- 		-

iam

- 		-

iam.object delete

- 		-

group deleted

-
-

4731

- 		-

 

- 		-

110002

- 		-

iam

- 		-

iam.object create

- 		-

group created

-
-

4732

- 		-

 

- 		-

111007

- 		-

iam

- 		-

iam.object modify

- 		-

group member added

-
-

4733

- 		-

 

- 		-

111008

- 		-

iam

- 		-

iam.object modify

- 		-

group member removed

-
-

4734

- 		-

 

- 		-

110501

- 		-

iam

- 		-

iam.object delete

- 		-

group deleted

-
-

4735

- 		-

 

- 		-

111009

- 		-

iam

- 		-

iam.object modify

- 		-

group properties modified

-
-

4737

- 		-

 

- 		-

111009

- 		-

iam

- 		-

iam.object modify

- 		-

group properties modified

-
-

4738

- 		-

 

- 		-

111000

- 		-

iam

- 		-

iam.object modify

- 		-

account account modified

-
-

4740

- 		-

 

- 		-

111500

- 		-

iam

- 		-

iam.object disable

- 		-

account locked

-
-

4741

- 		-

 

- 		-

110000

- 		-

iam

- 		-

iam.object create

- 		-

Account created

-
-

4742

- 		-

 

- 		-

111000

- 		-

iam

- 		-

iam.object modify

- 		-

account account modified

-
-

4743

- 		-

 

- 		-

110500

- 		-

iam

- 		-

iam.object delete

- 		-

account deleted

-
-

4754

- 		-

 

- 		-

110002

- 		-

iam

- 		-

iam.object create

- 		-

group created

-
-

4755

- 		-

 

- 		-

111009

- 		-

iam

- 		-

iam.object modify

- 		-

group properties modified

-
-

4756

- 		-

 

- 		-

111007

- 		-

iam

- 		-

iam.object modify

- 		-

group member added

-
-

4757

- 		-

 

- 		-

111008

- 		-

iam

- 		-

iam.object modify

- 		-

group member removed

-
-

4758

- 		-

 

- 		-

110501

- 		-

iam

- 		-

iam.object delete

- 		-

group deleted

-
-

4764

- 		-

 

- 		-

111009

- 		-

iam

- 		-

iam.object modify

- 		-

group properties modified

-
-

4767

- 		-

 

- 		-

112000

- 		-

iam

- 		-

iam.object enable

- 		-

account unlocked

-
-

4768

- 		-

 

- 		-

100000
102002 -

- 		-

authentication

- 		-

authentication.logon
authentication.kerberos requests -

- 		-

logon
tgt request -

-
-

4769

- 		-

 

- 		-

102001

- 		-

authentication

- 		-

authentication.kerberos requests

- 		-

service ticket requested

-
-

4770

- 		-

 

- 		-

102000

- 		-

authentication

- 		-

authentication.kerberos requests

- 		-

service ticket renewed

-
-

4771

- 		-

 

- 		-

100000
100500 -

- 		-

authentication

- 		-

authentication.logon
authentication.credential validation -

- 		-

logon
credential validation -

-
-

4776

- 		-

 

- 		-

100500

- 		-

authentication

- 		-

authentication.credential validation

- 		-

credential validation

-
-

4778

- 		-

 

- 		-

100004

- 		-

authentication

- 		-

authentication.logon

- 		-

session reconnect

-
-

4779

- 		-

 

- 		-

102501

- 		-

authentication

- 		-

authentication.logoff

- 		-

session disconnect

-
-

4781

- 		-

 

- 		-

111003

- 		-

iam

- 		-

iam.object modify

- 		-

account renamed

-
-

4798

- 		-

 

- 		-

119500

- 		-

iam

- 		-

iam.information

- 		-

IAM message

-
-

4799

- 		-

 

- 		-

119500

- 		-

iam

- 		-

iam.information

- 		-

IAM message

-
-

4820

- 		-

 

- 		-

101501

- 		-

authentication

- 		-

authentication.access policy

- 		-

device policy violation

-
-

4821

- 		-

 

- 		-

101500

- 		-

authentication

- 		-

authentication.access policy

- 		-

access policy violation

-
-

4822

- 		-

 

- 		-

101502

- 		-

authentication

- 		-

authentication.access policy

- 		-

account policy violation

-
-

4823

- 		-

 

- 		-

101502

- 		-

authentication

- 		-

authentication.access policy

- 		-

account policy violation

-
-

4824

- 		-

 

- 		-

101502

- 		-

authentication

- 		-

authentication.access policy

- 		-

account policy violation

-
+

+ The Windows Security technology pack will provide normalization and + enrichment to the following Windows security event log IDs:

+ + + Windows Security Event IDs List + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+

Event ID

+ 		+

Additional Data

+ 		+

gim_event_type_code

+ 		+

gim_event_category

+ 		+

gim_event_subcategory

+ 		+

gim_event_type

+
+

1100

+ 		+

 

+ 		+

220101

+ 		+

audit

+ 		+

audit.state

+ 		+

audit service stopped

+
+

1101

+ 		+

 

+ 		+

220102

+ 		+

audit

+ 		+

audit.state

+ 		+

audit error

+
+

1102

+ 		+

 

+ 		+

220000

+ 		+

audit

+ 		+

audit.integrity

+ 		+

audit log cleared

+
+

1104

+ 		+

 

+ 		+

220102

+ 		+

audit

+ 		+

audit.state

+ 		+

audit error

+
+

4610

+ 		+

 

+ 		+

270000

+ 		+

registry

+ 		+

registry.default

+ 		+

registry event

+
+

4611

+ 		+

 

+ 		+

270000

+ 		+

registry

+ 		+

registry.default

+ 		+

registry event

+
+

4614

+ 		+

 

+ 		+

270000

+ 		+

registry

+ 		+

registry.default

+ 		+

registry event

+
+

4616

+ 		+

 

+ 		+

260000

+ 		+

registry

+ 		+

registry.default

+ 		+

registry event

+
+

4622

+ 		+

 

+ 		+

270000

+ 		+

registry

+ 		+

registry.default

+ 		+

registry event

+
+

4624

+ 		+

 

+ 		+

100000

+ 		+

authentication

+ 		+

authentication.logon

+ 		+

logon

+
+

4625

+ 		+

 

+ 		+

100000

+ 		+

authentication

+ 		+

authentication.logon

+ 		+

logon

+
+

4634

+ 		+

 

+ 		+

102500

+ 		+

authentication

+ 		+

authentication.logoff

+ 		+

logoff

+
+

4647

+ 		+

 

+ 		+

102500

+ 		+

authentication

+ 		+

authentication.logoff

+ 		+

logoff

+
+

4648

+ 		+

 

+ 		+

100003

+ 		+

authentication

+ 		+

authentication.logon

+ 		+

logon with alternate credentials

+
+

4663

+ 		+

Access Type: ReadEA

+ 		+

209999

+ 		+

file

+ 		+

file.default

+ 		+

file event

+
+

4663

+ 		+

Access Type: ReadData (or ListDirectory)

+ 		+

201500

+ 		+

file

+ 		+

file.access

+ 		+

file access

+
+

4663

+ 		+

Access Type: WriteData (or AddFile)

+ 		+

201000

+ 		+

file

+ 		+

file.modify

+ 		+

file modified

+
+

4663

+ 		+

Access Type: AppendData (or AddSubdirectory or CreatePipeInstance)

+ 		+

201000

+ 		+

file

+ 		+

file.modify

+ 		+

file modified

+
+

4663

+ 		+

Access Type: Notify about changes to keys

+ 		+

259999

+ 		+

registry

+ 		+

registry.default

+ 		+

registry event

+
+

4663

+ 		+

Access Type: Enumerate sub-key

+ 		+

259999

+ 		+

registry

+ 		+

registry.default

+ 		+

registry event

+
+

4663

+ 		+

Access Type: Create sub-key

+ 		+

250500

+ 		+

registry

+ 		+

registry.key_change

+ 		+

registry key added

+
+

4663

+ 		+

Access Type: Set key value

+ 		+

250000

+ 		+

registry

+ 		+

registry.value_change

+ 		+

registry value set

+
+

4663

+ 		+

Access Type: Query key value

+ 		+

259999

+ 		+

registry

+ 		+

registry.default

+ 		+

registry event

+
+

4663

+ 		+

Access Type: WriteEA

+ 		+

209999

+ 		+

file

+ 		+

file.default

+ 		+

file event

+
+

4672

+ 		+

 

+ 		+

101000

+ 		+

authentication

+ 		+

authentication.access notice

+ 		+

special logon

+
+

4688

+ 		+

 

+ 		+

190000

+ 		+

process

+ 		+

process.execution

+ 		+

process started

+
+

4689

+ 		+

 

+ 		+

190100

+ 		+

process

+ 		+

process.end

+ 		+

process stopped

+
+

4697

+ 		+

 

+ 		+

211500

+ 		+

service

+ 		+

service.state

+ 		+

service installed

+
+

4720

+ 		+

 

+ 		+

110000

+ 		+

iam

+ 		+

iam.object create

+ 		+

account created

+
+

4722

+ 		+

 

+ 		+

112001

+ 		+

iam

+ 		+

iam.object enable

+ 		+

account enabled

+
+

4723

+ 		+

 

+ 		+

111004

+ 		+

iam

+ 		+

iam.object modify

+ 		+

password change

+
+

4724

+ 		+

 

+ 		+

111005

+ 		+

iam

+ 		+

iam.object modify

+ 		+

administrative password reset

+
+

4725

+ 		+

 

+ 		+

111501

+ 		+

iam

+ 		+

iam.object disable

+ 		+

account disabled

+
+

4726

+ 		+

 

+ 		+

110500

+ 		+

iam

+ 		+

iam.object delete

+ 		+

account deleted

+
+

4727

+ 		+

 

+ 		+

110002

+ 		+

iam

+ 		+

iam.object create

+ 		+

group created

+
+

4728

+ 		+

 

+ 		+

111007

+ 		+

iam

+ 		+

iam.object modify

+ 		+

group member added

+
+

4729

+ 		+

 

+ 		+

111008

+ 		+

iam

+ 		+

iam.object modify

+ 		+

group member removed

+
+

4730

+ 		+

 

+ 		+

110501

+ 		+

iam

+ 		+

iam.object delete

+ 		+

group deleted

+
+

4731

+ 		+

 

+ 		+

110002

+ 		+

iam

+ 		+

iam.object create

+ 		+

group created

+
+

4732

+ 		+

 

+ 		+

111007

+ 		+

iam

+ 		+

iam.object modify

+ 		+

group member added

+
+

4733

+ 		+

 

+ 		+

111008

+ 		+

iam

+ 		+

iam.object modify

+ 		+

group member removed

+
+

4734

+ 		+

 

+ 		+

110501

+ 		+

iam

+ 		+

iam.object delete

+ 		+

group deleted

+
+

4735

+ 		+

 

+ 		+

111009

+ 		+

iam

+ 		+

iam.object modify

+ 		+

group properties modified

+
+

4737

+ 		+

 

+ 		+

111009

+ 		+

iam

+ 		+

iam.object modify

+ 		+

group properties modified

+
+

4738

+ 		+

 

+ 		+

111000

+ 		+

iam

+ 		+

iam.object modify

+ 		+

account account modified

+
+

4740

+ 		+

 

+ 		+

111500

+ 		+

iam

+ 		+

iam.object disable

+ 		+

account locked

+
+

4741

+ 		+

 

+ 		+

110000

+ 		+

iam

+ 		+

iam.object create

+ 		+

Account created

+
+

4742

+ 		+

 

+ 		+

111000

+ 		+

iam

+ 		+

iam.object modify

+ 		+

account account modified

+
+

4743

+ 		+

 

+ 		+

110500

+ 		+

iam

+ 		+

iam.object delete

+ 		+

account deleted

+
+

4754

+ 		+

 

+ 		+

110002

+ 		+

iam

+ 		+

iam.object create

+ 		+

group created

+
+

4755

+ 		+

 

+ 		+

111009

+ 		+

iam

+ 		+

iam.object modify

+ 		+

group properties modified

+
+

4756

+ 		+

 

+ 		+

111007

+ 		+

iam

+ 		+

iam.object modify

+ 		+

group member added

+
+

4757

+ 		+

 

+ 		+

111008

+ 		+

iam

+ 		+

iam.object modify

+ 		+

group member removed

+
+

4758

+ 		+

 

+ 		+

110501

+ 		+

iam

+ 		+

iam.object delete

+ 		+

group deleted

+
+

4764

+ 		+

 

+ 		+

111009

+ 		+

iam

+ 		+

iam.object modify

+ 		+

group properties modified

+
+

4767

+ 		+

 

+ 		+

112000

+ 		+

iam

+ 		+

iam.object enable

+ 		+

account unlocked

+
+

4768

+ 		+

 

+ 		+

100000
102002 +

+ 		+

authentication

+ 		+

authentication.logon
authentication.kerberos requests +

+ 		+

logon
tgt request +

+
+

4769

+ 		+

 

+ 		+

102001

+ 		+

authentication

+ 		+

authentication.kerberos requests

+ 		+

service ticket requested

+
+

4770

+ 		+

 

+ 		+

102000

+ 		+

authentication

+ 		+

authentication.kerberos requests

+ 		+

service ticket renewed

+
+

4771

+ 		+

 

+ 		+

100000
100500 +

+ 		+

authentication

+ 		+

authentication.logon
authentication.credential validation +

+ 		+

logon
credential validation +

+
+

4776

+ 		+

 

+ 		+

100500

+ 		+

authentication

+ 		+

authentication.credential validation

+ 		+

credential validation

+
+

4778

+ 		+

 

+ 		+

100004

+ 		+

authentication

+ 		+

authentication.logon

+ 		+

session reconnect

+
+

4779

+ 		+

 

+ 		+

102501

+ 		+

authentication

+ 		+

authentication.logoff

+ 		+

session disconnect

+
+

4781

+ 		+

 

+ 		+

111003

+ 		+

iam

+ 		+

iam.object modify

+ 		+

account renamed

+
+

4798

+ 		+

 

+ 		+

119500

+ 		+

iam

+ 		+

iam.information

+ 		+

IAM message

+
+

4799

+ 		+

 

+ 		+

119500

+ 		+

iam

+ 		+

iam.information

+ 		+

IAM message

+
+

4820

+ 		+

 

+ 		+

101501

+ 		+

authentication

+ 		+

authentication.access policy

+ 		+

device policy violation

+
+

4821

+ 		+

 

+ 		+

101500

+ 		+

authentication

+ 		+

authentication.access policy

+ 		+

access policy violation

+
+

4822

+ 		+

 

+ 		+

101502

+ 		+

authentication

+ 		+

authentication.access policy

+ 		+

account policy violation

+
+

4823

+ 		+

 

+ 		+

101502

+ 		+

authentication

+ 		+

authentication.access policy

+ 		+

account policy violation

+
+

4824

+ 		+

 

+ 		+

101502

+ 		+

authentication

+ 		+

authentication.access policy

+ 		+

account policy violation

+
+ + +

+ Windows Message Size Reduction Companion Pack +

+

+ The Illuminate bundle includes an optional pack with the title + Microsoft Windows Security Message Size + Reduction that, when enabled, trims the descriptive text + appended to many Microsoft Security event log messages. This + text—located at the end of the message field—can be + helpful when examining individual events but is typically + unnecessary when analyzing logs in aggregate. +

+

+ Before enabling the Message Size Reduction Pack, consider any + requirements to retain the full, unaltered message content, as well + as the potential performance implications. After activation, + monitor your Graylog cluster to ensure that the additional + processing overhead does not negatively affect system performance. +

+

+ Retention of the winlogbeat_event_original Field +

+

+ Modern versions of the Elastic agent Winlogbeat include a field named + winlogbeat_event_original. This field contains + the original XML-formatted message representing the full source event + collected from the Windows Event Log subsystem. By default, this field is + removed due to its size and redundant nature. However, enabling the pack + titled Winlogbeat Event Original Retention + will restore it. +

\ No newline at end of file