Setup.evtx

[cboillot]

Is it possible with the Windows Add-on to pull the setup.evtx log?

[alemarzu]

Hi @cboillot 

I guess you could, I've done something similar with other evtx files just add a new input stanza in your local directory, like so.

[WinEventLog://setup]
sourcetype = WinEventLog
source = WinEventLog:Setup
index = <your_index>
disabled = 0
...