We are using fluentbit, loki, grafana to collect windows logs. I need to provide regular windows audits to my management. I can see that fluentbit is forwarding application, system, and security EventIDs. From Grafana I select loki as my data source and select EventID I only see 48 EventIDs in Grafana . However none of the Event IDs are what I need to conduct a Security Audit. How can I tell where the disconnect is that I don’t see more eventids? I am looking for logins/logoffs, account locks, disables, shutdown/powerups, file monitoring, etc. Has anybody gotten Windows Event logs for security audits to work?
This topic was automatically closed 365 days after the last reply. New replies are no longer allowed.