Organized by events ID module

[admarnelson]

I was thinking. it was very good if has EVENT ID Module (all events from hosts and network in one modules). I mean:
when we are hunting for threat analysts looking for network and hosts events ID, hash value to get better understand what's up and getting a module related events ID will help quick hunting and correlate with diferents modules or value.

Best regards team

AdmarNelson
CyberAnalyst SOC

[dougburks]

I'm not sure I understand what you're asking. Please provide more detail and an example or screenshots if possible.

[admarnelson]

Windows Event ID Module, if agents are installed. it helps us hunting. sorry my bad English

[dougburks]

If you are collecting Windows event logs, then the Windows Event ID should be available in the event.code field:
https://www.elastic.co/guide/en/ecs/current/ecs-event.html#field-event-code

Here's an example from our Hunt interface: