I’m new to Graylog and am evaluating it for possible purchase. I’ve set up 4 notifications all for Windows user account changes. The problem is that the alert email does not show me who created/altered the account or what account was created/altered. I’ve searched google and the documentation for the answers and can not find anything. Also the source always shows as Graylog instead of the actual source of the Windows event.
Body template
— [Event Definition] ---------------------------
Title: {event_definition_title}
Description: {event_definition_description}
Type: {event_definition_type}
--- [Event] --------------------------------------
Timestamp: {event.timestamp}
Message: {event.message}
Source: {event.source}
Key: {event.key}
Priority: {event.priority}
Alert: {event.alert}
Timestamp Processing: {event.timestamp}
Timerange Start: {event.timerange_start}
Timerange End: {event.timerange_end}
Fields:
{foreach event.fields field} {field.key}: {field.value}
{end}
{if backlog}
--- [Backlog] ------------------------------------
Last messages accounting for this alert:
{foreach backlog message}
{message}
{end}
${end}