It seems we are not the first to be seeing this issue. The vendor for a product called Event Log Explorer described the same problem, as it affected their product, blogged about the issue back in October. See "Windows Event Log API Bug Ruins Most Event Log Software". ... View more

You're totally right. This seems like a regression in Windows. While I am seeing the described behavior in Windows 11 24H2 (top), I am not seeing it in Server 2019 1809 (bottom). Good find! ... View more

I ran a packet capture with Wireshark and learned that the TaskCategory is being manipulated on the UF side. Note the TaskCategory of "Process Termination" where it should have been "Logon". Wireshark: Event Viewer: Event Viewer (Copy Details as Text):   ... View more

I used the "Copy Details as Text" option in Event Viewer for an arbitrary event on the source UF to view the Classic and XML formatted version of the event. The XML version contains an integer for the Task value, which I understand is used by the TA to obtain the TaskCategory via lookup table. The Classic version contains the "Task Category" field by default. Poking through the TA's props.conf, I don't see any destructive logic that would cause "Task Category" in Classic to be overwritten, just field aliasing as far as I can tell.   ... View more

I pulled _raw (Show Source) for the events in my screenshot and the "TaskCategory" value matches the table output, no "Task" field to be found though. I also checked the text-based versions of logs on the generating host and the "TaskCategory" values for the original events track with what I would expect them to be, so the issue seems to be between the UF and Indexer. 11/21/2025 08:28:19 AM LogName=Security EventCode=4689 EventType=0 ComputerName=DESKTOP-1VBIRTE SourceName=Microsoft Windows security auditing. Type=Information RecordNumber=291156 Keywords=Audit Success TaskCategory=Process Termination OpCode=Info Message=A process has exited. Subject: Security ID: NT AUTHORITY\SYSTEM Account Name: DESKTOP-1VBIRTE$ Account Domain: WORKGROUP Logon ID: 0x3E7 Process Information: Process ID: 0x714 Process Name: C:\Windows\System32\svchost.exe Exit Status: 0x0 11/21/2025 08:28:19 AM LogName=Security EventCode=4688 EventType=0 ComputerName=DESKTOP-1VBIRTE SourceName=Microsoft Windows security auditing. Type=Information RecordNumber=291155 Keywords=Audit Success TaskCategory=Process Termination OpCode=Info Message=A new process has been created. Creator Subject: Security ID: NT AUTHORITY\SYSTEM Account Name: DESKTOP-1VBIRTE$ Account Domain: WORKGROUP Logon ID: 0x3E7 Target Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x2728 New Process Name: C:\Windows\System32\svchost.exe Token Elevation Type: TokenElevationTypeDefault (1) Mandatory Label: Mandatory Label\System Mandatory Level Creator Process ID: 0x338 Creator Process Name: C:\Windows\System32\services.exe Process Command Line: ...[truncated for brevity] 11/21/2025 08:28:19 AM LogName=Security EventCode=4672 EventType=0 ComputerName=DESKTOP-1VBIRTE SourceName=Microsoft Windows security auditing. Type=Information RecordNumber=291153 Keywords=Audit Success TaskCategory=Process Termination OpCode=Info Message=Special privileges assigned to new logon. Subject: Security ID: NT AUTHORITY\SYSTEM Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3E7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege 11/21/2025 08:28:19 AM LogName=Security EventCode=4670 EventType=0 ComputerName=DESKTOP-1VBIRTE SourceName=Microsoft Windows security auditing. Type=Information RecordNumber=291154 Keywords=Audit Success TaskCategory=Process Termination OpCode=Info Message=Permissions on an object were changed. Subject: Security ID: NT AUTHORITY\SYSTEM Account Name: DESKTOP-1VBIRTE$ Account Domain: WORKGROUP Logon ID: 0x3E7 Object: Object Server: Security Object Type: Token Object Name: - Handle ID: 0x860 Process: Process ID: 0x338 Process Name: C:\Windows\System32\services.exe Permissions Change: Original Security Descriptor: D:(A;;GA;;;SY)(A;;RCGXGR;;;BA) New Security Descriptor: D:(A;;GA;;;SY)(A;;RC;;;OW)(A;;GA;;;NT SERVICE\gpsvc) 11/21/2025 08:28:19 AM LogName=Security EventCode=4627 EventType=0 ComputerName=DESKTOP-1VBIRTE SourceName=Microsoft Windows security auditing. Type=Information RecordNumber=291152 Keywords=Audit Success TaskCategory=Process Termination OpCode=Info Message=Group membership information. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-1VBIRTE$ Account Domain: WORKGROUP Logon ID: 0x3E7 Logon Type: 5 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3E7 Event in sequence: 1 of 1 Group Membership: BUILTIN\Administrators Everyone NT AUTHORITY\Authenticated Users Mandatory Label\System Mandatory Level ...[truncated for brevity] 11/21/2025 08:28:19 AM LogName=Security EventCode=4624 EventType=0 ComputerName=DESKTOP-1VBIRTE SourceName=Microsoft Windows security auditing. Type=Information RecordNumber=291151 Keywords=Audit Success TaskCategory=Process Termination OpCode=Info Message=An account was successfully logged on. Subject: Security ID: NT AUTHORITY\SYSTEM Account Name: DESKTOP-1VBIRTE$ Account Domain: WORKGROUP Logon ID: 0x3E7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: No Elevated Token: Yes Impersonation Level: Impersonation New Logon: Security ID: NT AUTHORITY\SYSTEM Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3E7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x338 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 ...[truncated for brevity] ... View more

I just had this same problem with 6.4.0 and found a workaround. The Tenable docs for Add-On describe a setting "Verify SSL Certificate" that for whatever reason is not visible from the UI. https://docs.tenable.com/integrations/Splunk/Content/Splunk2/ConfigureTenablescCertificatesS2.htm Modify /opt/splunk/etc/apps/TA-tenable/bin/tenable_consts.py Change True to False where applicable to your deployment. Save and close the file. No restart required. verify_ssl_for_ot = False verify_ssl_for_sc_cert = False verify_ssl_for_sc_api_key = False verify_ssl_for_sc_creds = False   ... View more