source of user-id data
I'm troubleshooting what appears to be an issue with user-id. I want to confirm I'm identifying the correct Window Event Logs the User-ID Agent captures to populate the User-ID data. I'm reviewing the logs in Splunk, so the source is shows as WinEventLog:Security. It of course contains the source IP, username, and a message indcating a logon eve...




