I'm trying to add some valuemapping to the winevent_nic parser. I want
to replace the logon windows types and status/substatus'. Here is what I
have as my valuemaps in the parser. I've done this before on other parsers, but this one
just isn't playi...
We had a similar issue when adding ePO. I found this on RSA's site.
https://community.rsa.com/docs/DOC-47749 We were getting thousands of
log sources because each endpoint was being logged as an individual log
source instead of only the database IP.
