It looks like you're new here. If you want to get involved, click one of these buttons!
I'm using OSSIM 5.1 and I try to get all events logged on forwardedEvents.evtx from my W2012 R2 server.
I have installed OSSEC agent on my Server and add this config :
I get already all events logged on security.evtx from this server, but not those from forwardedEvents file.
Do you know how can I solve that (restart server and Agent is already done) ?