Poor mssccm parsing?

[MaximilianoCitt]

recently one of my customers wanto to add a Microsoft System Configuration Center Manager to Netwitness 10.6. He made the configuration of the mssccm server and I have done the configuration of the collection. Everything seems to be working fine but when I want to view the events, I saw the parser only parse a few metadatas and almost all of the raw message is placed to the event.desc meta lossing sight about the source username, destination username and the action taken. 

Could anyone tell me if there is something wrong with the parser or is just the way of that parser works?

These are two screenshots of an event (account modification) where you may see user dst, user src and roles, but no one of this data is parsed well

thanks in advance for your help

[EricPartington]

a few things to check first.

make sure the parser is subscribed or updated from RSA live to get the latest version if there is something new.

Make sure the parser updates on the decoder(s), some times the content gets updated but not deployed (stuck).

review the reference id in the parser (or on GitHub) to see if there are any small changes that may cause this to fall to a 'default catch all' type log parser that might need to be altered to get more out of the log (and hopefully open either support issue to get this resolved or submit pull via GitHub) or it may just need some additional attention to extract more information from the event.