Is it possible to add windows 10 as WMI data-source ? does SIEM support it?
I tried to add the data-source in a way like the standard WMI configuration, its not working i get the below errors
WMI Event Log test connection unsuccessful. The user does not have the correct permissions. The UAC or WMI setting may need to change.
if i use RPC below error:
WMI Event Log test connection unsuccessful. result was NT_STATUS_ACCESS_DENIED
We have configured the account as per standard steps, is some other configuration we need to do it specially for windows 10?
Solved! Go to Solution.
I think windows 10 is only supported from 9.6.1 onwards. The error you got shows that the user account you used doesn't have enough permission to pull WMI.