Regarding Absence of Windows Security Command Line Events in Logs

[smith_]

hi ,

We could be the  issue regarding the absence of Windows Security Command Line " EventCode=4688 ParentProcessName="C:\\Windows\\System32\\cmd.exe"  events.
I have not blacklisted it in any of the app.

Thanks.

[bharathkumarnec]

@smith_ Can you may be run btool to check the full configuration?

[smith_]

@bharathkumarnec 

Hi, Where exactly we can run this btool to check the configurations. I dnt have back end access can we check in ui.

[bharathkumarnec]

@smith_ 
$SPLUNK_HOME$/bin/splunk btool inputs list --debug

[smith_]

@bharathkumarnec  Hi,

After investigating I came across audit process creation is this causing this issue ??
https://docs.splunk.com/Documentation/ES/7.2.0/Admin/ConfigureLogging

[bharathkumarnec]

@smith_ please check if the source is generating the data in the event viewer with the information that you are looking ?

[smith_]

@bharathkumarnec ,

Yes, it is generating the data in the event viewer!