Skip to main content
adem_netsys
adem_netsys
Explorer III
June 13, 2025
Question

Some Windows Security Logs Issue with Windows Agent

  • June 13, 2025
  • 1 reply
  • 421 views

Hi guys,

 

We're facing a problem. We are getting Windows logs with Windows Agent, but we are getting some logs and not getting some logs. For example, we cannot get some of the MSSQLServer33205 logs and some of them, in addition, we cannot see the log with ID 1104 in Events. What can we do for this? Agent Version 7.2.5.

 

Thanks in advance

    1 reply

    cdurkin_FTNT
    Staff
    cdurkin_FTNT
    Staff
    June 16, 2025

    Probably best bet would be to you look in detail on the windows side at what the "EventRecordID" is for the missing entries .. you can view this under Details/Friendly View in the Windows Event Viewer.

    eventRecordID.png

    Then you can search for the corresponding ID in FortiSIEM...

    eventRecordID_FSM.png

    By either a Keyword Search... or by searching Reporting IP = x.x.x.x and Sequence Number = <ID>

    If you do in fact have missing entries, then I would suggest a TAC ticket.

    Terms & ConditionsAccessibility statement
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!