windows_eventlog tuning

[5MI7th3MI6]

Hello,

I am getting a lot of general windows_eventlogs for alerts, any idea of how I can tune them?

[dougburks]

Depends on how your Windows logs are coming in:
https://docs.securityonion.net/en/2.3/host.html