We are currently pulling windows security events from multiple Windows domain controllers and received issues with the amount events indexed which constantly violates or license.
We have windows logon events (event code: 4624) that capture both user information logons as well as machine logons. There are so many of these logon events that we dont need and would like to remove it in order to stay within the license limit.
The security events also have a large description included in the event under the event type "Message" that would like to be removed.
... View more