I have a problem that had occurred a little while ago, the metadata for source has disappeared from all windows events, however it remains on other events. This has not really been a problem up until now when setting up Enterprise Security, where some of the macros e.g. `powershell`, which selects events based on the source. The strange part about this is problem is that field extractions based on the source still seem to work, e.g. the Sysmon app (adapted to work with plain text rather than xml) is extracting `process_name` properly. Does anyone know why this may be? Any help is greatly appreciated.
... View more