Skip to content

host_fqdn field not correctly extracted due to TA-windows new versions #102

@timo92700

Description

@timo92700

Hello everyone,
It appears that the "host_fqdn" field evaluation in the props.conf for stanza : "WinEventLog:Microsoft-Windows-Sysmon/Operational" ( And also the XML one ) is based on "Computer" field, but TA-windows seems to have renamed this field to "ComputerName" for a few version now ( i'm running TA windows v8.2.0 ).
This issue causes 90% of the dashboards not working at all.
You have to edit the props.conf as below to make it work again correctly ( in both WinEventLog:Micro**** and XMLWinEventLog:Micro**** stanzas if needed) :
image

Could you please fix the issues in the application ?
Thanks and regards,

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions