topic Clarification on WinEventLog vs wineventlog sourcetype? in Getting Data In

Clarification on WinEventLog vs wineventlog sourcetype?

TheBravoSierra — Mon, 05 Jun 2023 21:08:16 GMT

Hi all,

I have data coming in, parsing and indexing correctly to a windows index. This data comes in with either one of two sourcetypes: "WinEventLog" and "wineventlog". The sources appear to be the same, so I am having difficulty understanding what corresponds to each sourcetype. Any help is appreciated. Thank you.

Re: WinEventLog vs wineventlog sourcetype

PickleRick — Mon, 05 Jun 2023 20:17:46 GMT

Since sourcetype is case-sensitive (regarding props.conf and event processing) so strictly technically these are two distinct sourcetypes. It seems though that for some reason (probably backwards compatibility) they share definitions in TA-windows.

Generally, you should be using the new name - WinEventLog.

Re: Clarification on WinEventLog vs wineventlog sourcetype?

VatsalJagani — Tue, 06 Jun 2023 05:16:10 GMT

@TheBravoSierra - Are you having Sysmon data? That may have "wineventlog" (lower case) sourcetype value.