Skip to main content
MonXbebe
Explorer
October 8, 2024
Solved

Windows Agent, PowerShell Events

  • October 8, 2024
  • 1 reply
  • 853 views

Hello,

 

while testing in our system I noticed that PowerShell and Sysmon events are not arriving in the SIEM system. Other events such as Windows Event ID 4624 arrive without any problems. The template is defined for the PowerShell events Microsoft-Windows-PowerShell/Operational and Windows PowerShell. The local security guidelines are also set. I'm using Windows Agent 7.2.2. What am I doing wrong?

 

Best Regards

Best answer by MonXbebe

If anyone has a similar problem. The update to WindowsAgent 7.2.4 has helped...

1 reply

MonXbebe
MonXbebeAuthorAnswer
Explorer
October 8, 2024

If anyone has a similar problem. The update to WindowsAgent 7.2.4 has helped...

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!