I was having an issue with this as well, till I searched further back in the past.  I am running into a problem with the Time stamp not getting the Received time.  I am looking in the props.conf to see if I can fix it. ... View more

So, I know this is an older post, but I am having this problem as well.  I am seeing the 4624 and then also the 4776.  So, the question is should we tweak the windows TA to remove the tags for all but the 4624 events? ... View more

@bmorgenthaler, I know this thread is 6 months old. I had emailed fp-4-splunkATcisco.com regarding this. I am trying to work with the FirePower devs to get this resolved. I created an event type and tag for the malware event like you had above, but I get a lot more events than what is malware. Have you had any luck in cleaning this up? ... View more

Per this: https://docs.splunk.com/Documentation/WindowsAddOn/7.0.0/User/Upgrade It talks about using msad, wineventlog, perfmon, winevents, and windows indexes. Prior to me seeing the SSE on boarding a few weeks ago, I was unaware of using oswin, oswinsec, and oswinscript indexes. I am going through and updating my TA_windows to make use of these. The question though, is do I leave all the admon stanzas to point to msad ? ... View more

Did you ever get this resolved? I am seeing this as well. ... View more

Did you ever get this resolved? I am seeing this as well. ... View more