Hi ArcSight fans,
I am looking into an issue with Windows DC logs. I'm pulling security logs from a few DC's and wanted to know if there is any way for me to capture WHERE a user is logging into.
I get an awful lot of information about each user login and session, but I want to see which device they are connecting to.
Any ideas? is it an event ID that I can switch on?