Elastic Agent/Fleet - Winlog input missing security events

Hey all

I'm working on deploying a Elastic stac POC but have hit a strange issue with collecting windows security event logs

Environment

  • Elasticsearch/Kibana/Fleet Server: 9.5.1
  • Tested Elastic Agent: 9.5.1 and 9.4.2
  • Windows Server 2019 domain controller
  • Agent installed as a Windows service running as NT AUTHORITY\SYSTEM
  • Fleet System integration has Application, Security and System enabled
  • Other Windows Event Logs are ingesting correctly (Application, System, PowerShell, Directory Service, DNS Server, Defender, etc.)

The problem is specifically i'm not seeing any "Security" event log data.

Running the following discover, I get no data

>host.name : "SERVERNAME" and data_stream.dataset : "system.security"

I can confirm there are security event

>Get-WinEvent -LogName Security -MaxEvents 10

Fleet senders the stream correct and elastic agent seems to be working

>Starting to read from Security
Reading from Security
windows event log opened successfully

I've tested this on a couple of machine's which have similar outcomes, missing security events. standalone WinLogBeat works on the same server with a simple config

>winlogbeat.event_logs:
- id: security-test
xml_query: >
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">*</Select>
</Query>
</QueryList>

But this doesn't work

>winlogbeat.event_logs:
- name: Security

Any suggestions where to go from here?

reddit.com
u/Whole_Photograph4698 — 8 days ago

Power/light control - australia

Hi all

Wondering what the best options for light/PowerPoint control in Australia are. I've had a play with some grid connect power adapters from Bunnings, but looking for something that can integrate with home assist in the future.

Main features I would like are:

* Ability to turn on/off from mobile/home assiste

* Power meter - track power draw on certain power points for/appliances

* Schedules - ability to turn on/off PowerPoint on schedule or event.

The grid connect seems good but not sure if I can get granular power usage as it all seems per day/month, would like per hour. I would like to find something that can integrate with home assist easily as the long term and in my custom home dashboard if possible (but could route via HA).

Prefer with replacing plugs/switches with new devices as opposed to plug in, also would like the ability to have sensors (temp/humidity?).

What's a good tech stack that is reasonably priced and available commonly in AUS?

Cheers

S

reddit.com
u/Whole_Photograph4698 — 19 days ago

Shifting tower advice

Hi all

Seeking some advice on this print. Every time I print this the tower shifts about 2/3 of the way into the print. Everything else holds and prints nicely and I've been able to save the prints with some creative placement of it after the fact, few defects but salvageable. I'm printing them this way as I find I get the best finish this way, but open to advice.

Any advice on what I can do to ensure the tower holds? Will glue work in this case?

Any other prints before/after work fine.

Printing on a P2S, general default printer settings and variable later height.

u/Whole_Photograph4698 — 26 days ago

Business IT Mentoring (AUS)

Hi all

Recently taken over an internal IT team, been with the company many years (>10). I have a good knowledge of the IT systems, challenges and everything around it, but am struggling to get my brain in order around what we should be doing, how to do some of these things and how to elevate IT within the business.

Is there any sort of "mentoring" service in Australia that would give me a sounding board for discussion, help me organise and arrange my thoughts and surface and focus on the "big rocks".

Also professional mentoring around how best to handle/approach challenges with people/process/executives? Won't say no to professionsal development as well.

Thanks

reddit.com
u/Whole_Photograph4698 — 1 month ago

Help fix the first few layers.

Hi all.

&#x200B;

I'm printing a Lego man had and having issues with the quality at the beginning/touching spots. Initial prints were poor I tried to slow down the first few layers after my first few prints turned to spaghetti, but still having as per the attached. The rest of it (top) seems to have come out ok.

&#x200B;

I have also turned off the fans for the first few layers.

&#x200B;

Any advice where to start to get a better quality print? It's a bambu P2S using bambu filament. I'm very green in this space.

&#x200B;

All my setting are default as far as I can see.

&#x200B;

Cheers s

&#x200B;

&#x200B;

u/Whole_Photograph4698 — 2 months ago

Getting started in 3d printing

Hi all

&#x200B;

Picked up a p2s and have had great fun just pushing our things for the kids. I have a few questions and wondering if anyone can provide some good resources for upskilling.

&#x200B;

- what is the reason to use ABS, PTEG vs PLA?

- is there any specific difference in printing from the bambu app when using other material apart from PLA?

- what is the best maintenance works around cleaning and maintaining my machine?

- how am I best to store my filaments?

&#x200B;

Where are some of the learning sites around these questions and/or youtubers to watch?

&#x200B;

S

&#x200B;

reddit.com
u/Whole_Photograph4698 — 2 months ago

Learning kit for 12 year old (Aus)

Hi all.

&#x200B;

I have some basic experience in electronics and my son is showing interest. I'm looking for a good kit and some learning material that he can work through on his own and we can do together.

&#x200B;

I saw the tech toast ones but they seem expensive and the reviews are mixed. I can see lots of kits online but wondering what is a good learning book or online guides that he can use to work through at his own pace and which kits works be complementary.

&#x200B;

Thanks

S

reddit.com
u/Whole_Photograph4698 — 2 months ago

Unifi Cloud - Multiple Sites

Hi All

We currently have a windows VM running the Unifi Console and i'm wanting to move over to a UDM or CGU. Does anyone know if either support "sites" as we use them for our WIFI network accross multiple locations.

I can't seem to find the "multi-site management" option within my home UDM

S

reddit.com
u/Whole_Photograph4698 — 2 months ago