I've run into an issue with the Sysmon connector on machines running Sysmon v8. The network connect events are no longer properly formatted and information is lost. Below is a screenshot of two events, one from a machine running v8 and one running v7.2. Sysmon v8 added a field called Rule Name to the output, so perhaps this has thrown off the parser. Is this something that can be fixed with a connector update, or should I plan on keeping our machines on v7.2?
Thanks,
Joe
