Visit the Known Issues dashboard if you are experiencing issues on RSA Link
What metadata field will show windows security event ID numbers?
Found out it is listed under "msg.id" as, for example, "Security_4625_Microsoft-Windows-Security-Auditing" or "Security_680_Security:03"
View solution in original post
