Hello, I'm using Wazuh and I don't know how to map *TargetUserName* to an indexed field. Security events are generated but the associated username is not mapped so there is no way to search for or display the culprit.
The field marked yellow is not mapped or indexed. <https://lh3.googleusercontent.com/-vZgQQjh5oR4/WRVy-imuB4I/AAAAAAAAGR8/-HT_z361zhA07tN9aJKuusPwcHQ172C0QCLcB/s1600/Knipsel.PNG> Corresponding xml event from eventvwr <https://lh3.googleusercontent.com/--2WnSSr7JBI/WRVzge_22fI/AAAAAAAAGSE/40kj-6moS-Mt1HQ1_LwmCCQmwY-80X8dwCLcB/s1600/Knipsel2.PNG> I'm using the ossec-agent to transport logs to Wazuh v2.0 I hope someone can help me. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
