I try to collect Sysmon logfiles with AWS CloudWatchAgent.
How do I need to specify the event_name section in the config?
I tried these
"event_name": "Microsoft-Windows-Sysmon"
then (most obvious)
"event_name": "Microsoft-Windows-Sysmon/Operational"
and this
"event_name": "Sysmon"
But nothing works ...
Thanks
Robert