zhong
12/21/2021, 8:34 PMwindows_events
using SELECT * FROM windows_events WHERE keywords = "Audit Success";
, but getting this output. How would I go about enabling events?George
12/21/2021, 9:14 PMzwass
12/21/2021, 9:43 PMwindows_eventlog
table as well.zhong
12/22/2021, 8:24 PM--disable_events=false
flag and used the flags --windows_event_channels=Security
and --enable_windows_events_subscriber
to subscribe to the security event channel. now when I run the command, SELECT * FROM windows_events WHERE keywords = "Audit Success";
, I don't get any errors, but I do get a blank output. Is there a certain flag that I am missing or any further configuration I would need to do to get the events to show?