Windows security was onboarded as the custom sourcetype citywinsec…

Question

Windows security was onboarded as the custom sourcetype citywinsec instead of WinEventLog:Security. Security Essentials content keyed on the standard name shows nothing. Why?

Accepted Answer

Content discovery depends on the expected sourcetype or CIM tags, so a renamed sourcetype is invisible until it is mapped. — SSE looks for the nametag it was taught—WinEventLog:Security—not whatever nickname the city invented. citywinsec is invisible until someone aliases or CIM-tags it. Rename the mailbox, miss the mail.

Answer

Security Essentials cannot list Windows content unless the city buys ITSI.

Answer

Custom sourcetype names automatically inherit every standard Security Essentials mapping.

Answer

citywinsec events sit in a hidden index that Enterprise Security cannot search.

Windows security was onboarded as the custom sourcetype city_winsec instead of WinEventLog:Security. Security Essentials content keyed on the standard name shows nothing. Why?

Short Explanation

Full Explanation