Comments (5)
had the same issue.
from sysinternals.
Are you confirming this using the raw event XML on the WEC server or the event forwarded to your SIEM? If the WEC Sysmon event is not identical to the WEC client Sysmon event, then this is a problem with Windows Event Forwarding. I have personally experienced this behavior on the SIEM side, and that was caused by a bug in the SIEM.
from sysinternals.
Hi, I confirm it is on the WEC server itself (in the forwarded events logs) only when using the 'binary' format on the clients (/cf:Events). When using XML format it is working fine.
from sysinternals.
Thanks for reporting this, we are investigating.
from sysinternals.
Thank you for reporting this. I have added it to the Sysmon backlog
from sysinternals.
Related Issues (20)
- Update sysinternals/downloads/tcpview.md to list limitation in tcpvcon for no local/remote port output
- [BUG] TCPView64 v4.19 When Dark Theme is enabled same setting is not being applied on Windows 7 SP1 x64 Ultimate
- [BUG] ProcExp64 v17.5.0.0 no more displays expected context menu after selecting a process and pressing [Shift]+[F10]
- [BUG] ProcExp64 v17.5.0.0 almost always displays 'Resume' option in own context menu after selecting a process instead of expected 'Suspend' option HOT 1
- [BUG] ZoomIt64 v8.01 & v7.20 always hang and close after user simply tries to display its Options menu on Windows 7 SP1 x64 Ultimate
- [Feature] RDCMAN - add Darkmode HOT 11
- [DemoType] Characters are not correctly transmitted when using non QWERTY keyboard HOT 2
- [DemoType] ZoomIt64 v8.01 Polish diacritical characters HOT 1
- [Request] ZoomIt64 v8.01-dynamic zoom out time
- ZoomIt-ctrl+shift+alt+5 is NOT stop recording
- [BUG] Handle & Handle64 v5.0.0 incorrectly add "08X" to reported process handles # when using "... -u [name]" syntax HOT 2
- ZoomIt LiveZoom in clipchamp not working and cursor not visible HOT 5
- BGInfo doesn´t save custom field wmi query
- RDCMan protocol error 3334 - largeaddressaware HOT 2
- Sysmon64.exe -u removes logs from EventViewer HOT 1
- Is it abel to display color when PsExec a process on remote device? HOT 1
- [BUG] Contig64 v1.83 incorrectly shows wrong character (0xDE) instead of expected 'è' (0xE8)(=small'e'+graveAccent) when displaying a localized error message with an accented letter HOT 2
- [BUG] Strings64 v2.54 is unable to fully extract an error message if an accented character (i.e. 'è' (small'e'GraveAccent)) is present within.
- [BUG] Strings tab from ProcExp64 v17.5.0.0 can only partially display an error message if containing an accented character (i.e. 'è') and rest of error message is displayed 1 line below
- coreinfo - to show RDPMC and a few other items that don't have CPUID bits
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from sysinternals.