This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Privacy Policy. Click Preferences to customize your cookie settings.
Does anyone else have an issue with the SID S-1-5-18 (System /
LocalSystem)? It's not being pulled from our AD logs, and as a result,
it's just showing up as the SID within Chronicle. Has anyone
successfully mapped this to the Local System username?