I need help~
my acquis.yamal is
vent_ids:
- 4625
- 4623
event_level: information
labels:
type: eventlog
##Firewall
filenames:
- C:\Windows\System32\LogFiles\Firewall*.log
labels:
type: windows-firewall
##SQL Server
source: wineventlog
event_channel: Application
event_ids:
- 18456
event_level: information
labels:
type: eventlog
##IIS
use_time_machine: true
filenames:
- C:\inetpub\logs\LogFiles**.log
labels:
type: iis