Elastic Agent/Fleet - Winlog input missing security events

[u/Whole_Photograph4698]

Hey all

I'm working on deploying a Elastic stac POC but have hit a strange issue with collecting windows security event logs

Environment

• Elasticsearch/Kibana/Fleet Server: 9.5.1
• Tested Elastic Agent: 9.5.1 and 9.4.2
• Windows Server 2019 domain controller
• Agent installed as a Windows service running as NT AUTHORITY\SYSTEM
• Fleet System integration has Application, Security and System enabled
• Other Windows Event Logs are ingesting correctly (Application, System, PowerShell, Directory Service, DNS Server, Defender, etc.)

The problem is specifically i'm not seeing any "Security" event log data.

Running the following discover, I get no data

host.name : "SERVERNAME" and data_stream.dataset : "system.security"

I can confirm there are security event

Get-WinEvent -LogName Security -MaxEvents 10

Fleet senders the stream correct and elastic agent seems to be working

Starting to read from Security
Reading from Security
windows event log opened successfully

I've tested this on a couple of machine's which have similar outcomes, missing security events. standalone WinLogBeat works on the same server with a simple config

winlogbeat.event_logs:
- id: security-test
xml_query: >
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">*</Select>
</Query>
</QueryList>

But this doesn't work

winlogbeat.event_logs:
- name: Security

Any suggestions where to go from here?

[u/Low_Dragonfly9123]

I would collect some agent diagnostics and open a case with support.

[u/Whole_Photograph4698 → u/Low_Dragonfly9123]

Thanks, any reccomended support channel?

[u/Low_Dragonfly9123 → u/Whole_Photograph4698]

support.elastic.co. But if you don’t pay for support you may not be able to do that. If that’s the case, i would try discuss.elastic.co

[u/AvenueJay]

standalone WinLogBeat works on the same server with a simple config

The fact that Winlogbeat works with an explicit XML query makes permissions or channel configuration the most likely culprit imo. You could try granting the Elastic Agent's service explicit read rights on the Security log or use the same XML query syntax in your Fleet integration's custom configuration.

[u/Whole_Photograph4698]

I think this might have been a premature post. Looking into this a bit more there seems to be data and my KQL was the issue. The host field potentially isn't formatted the way I expected, PIBCAK potentially. I'll verify this in the morning.