by doing this, I am actually cancelling ALL existing Parsers (?) (for that specific windows event), meaning I have to re-create them in my new ASP rule?... hope I understood correctly.
if that is the case, it sounds very exhausting. is this the only solution?
I just want to add more data "on-top" of what already exists...
source user for example - sometimes extracted correctly and sometime it does not.
I want my ASP rule will provide another parsing layer in case the default one misses...
After selecting ‘Order ASP Rule’ you will have to click on the Custom tab and promote the specific custom rule to the highest order.
I would advise to go with Luke’ s recommendation to open a service request so that we can find out if the Windows default parser has any issues.
Unfortunately we cange add or change fields for winodws but this Article helped me. No need to add any new fields. McAfee had it implemented already .Just in a weird way. Works if you want to drill down using event ID.