defensivedepth
03/23/2021, 1:34 PMwindows_events
table to ship the sysmon logs?manu
03/23/2021, 6:09 PMwindows_events
being generic over diff channels and sources can't be projected generically. The data manipulation and types of queries that one create with such tables at endpoint itself opens a new set of opportunity.