AD Logs with no information

[RenatoGoncalves]

We are collecting logs from AD and we cannot see any useful information, like users accounts, logons or logoffs. Has you can see in the picture the result of the log doesnt gives much information. What can i do to receive important data like the one i mencioned?

[YasmineDowidar]

Hi j2iBRTJCUKR3JAh2yPVOkmdUKjcLBNaD4eYHhgvfjBM=,

I have moved this thread to the RSA NetWitness Suite‌ page so that you can get an answer to your question.

Thanks,

Yasmine

[EricPartington]

can you paste the raw event for that message (not the meta data?)

It looks like the parsing has matched the header but not the payload (word meta indicates that).  There could be a couple of reasons for that but seeing the raw data will help to determine why.

[EricPartington]

yes that was what i was looking for (ideally it would be pasted as text so it could be tested in another tool to verify   )

Looks like something is truncating your logs in some form or not gathering the relevant data to parse out.

How are you capturing these logs? Are there other windows logs that look the same as this or do others have more details?