Windows_TA vs Windows

[cachexploit]

I have two apps installed on Windows clients.  One looks like the full blown Windows_TA app and one looks like a truncated one.  I worked with a PS to get all these apps initially installed. 

Everything in the full Win_TA looks to be disabled.

The truncated one looks very simple and has some stanzas from the Win_TA app.

I made a change to the truncated one (a blacklist addition) and I believe this has taken.

Am I assuming correctly that the one app that has a truncated version of Windows TA is the actual app that is telling what logs for the Win hosts to send?

Also, if my assumption are correct, is this common practice?

[thambisetty]

you need an input to collect windows events logs that input can be added to any application name. it's not required to be in specific application name. The application name is required for you to understand what kind of inputs the application contains.

you can have one application for example:

windows_inputs and create local directory inside that and create inputs.conf inside that and add your input stanzas. its very simple. 

let me know if you still need some guidance.