defensivedepth
02/12/2021, 6:22 PMwindows_events
table does not pull in the Computer
field (I believe this is where it would be pulled out - https://github.com/osquery/osquery/blob/master/osquery/events/windows/windowseventlogparser.cpp#L145)
The Computer
field is extremely important because it is the hostname of the system that the log was originally generated on - it's common to aggregate Windows eventlogs to a few Windows systems using Windows Eventlog Forwarding (WEF) and then ship those to the backend system using something like Winlogbeat/Osquery etc. Without the Computer
field, the backend system has no idea of where the original log came from.
Further ref: https://docs.microsoft.com/en-us/windows/win32/wes/eventschema-computer-systempropertiestype-elementJuan Alvarez
02/12/2021, 6:31 PMseph
defensivedepth
02/12/2021, 7:10 PM