Sysmon parsing issue when empty field in forwardedevents

[microsoftdocs]

Sysmon parsing issue when empty field in forwardedevents

[mschilt]

had the same issue.

[jokezone]

Are you confirming this using the raw event XML on the WEC server or the event forwarded to your SIEM? If the WEC Sysmon event is not identical to the WEC client Sysmon event, then this is a problem with Windows Event Forwarding. I have personally experienced this behavior on the SIEM side, and that was caused by a bug in the SIEM.

[yorkvik]

Hi, I confirm it is on the WEC server itself (in the forwarded events logs) only when using the 'binary' format on the clients (/cf:Events). When using XML format it is working fine.

[lukekim]

Thanks for reporting this, we are investigating.

[analyze-v]

Thank you for reporting this. I have added it to the Sysmon backlog