Microsoft Common

Parsing Rule

Microsoft Logs Base

Details

IDMicrosoft_Common
From Version8.2.0

Rules (XQL)

[INGEST:vendor="microsoft", product="windows", target_dataset="microsoft_windows_raw", no_hit=keep]
filter time_created!= null
| alter _time = time_created;