Cribl Stream WEF Event 4688 CommandLine Is Missing After Migration

Symptom

Windows Security Event 4688 records arrive through a Cribl WEF Source, but the CommandLine field is null or absent for some events or endpoints. The field was populated when the same events were collected through a previous WEF/WEC path.

Environment

• Cribl Stream or Cribl Edge
• Windows Event Forwarder Source
• Windows Security Event 4688 process-creation records

Resolution

1. Capture a new raw Event 4688 record from an affected endpoint.
2. Verify that the raw XML contains a CommandLine element with a value.
3. Enable the Windows policy Include command line in process creation events if the raw event does not contain command-line data.
4. Verify that the policy is applied through the intended Group Policy or endpoint-management mechanism.
5. Generate a new Event 4688 record after policy propagation.
6. Verify the WEF subscription Format setting.
7. Test RenderedText if the raw subscription format does not expose the expected rendered field values.
8. Inspect the event after Cribl parsing if the raw XML contains command-line data.
9. Verify that the pipeline preserves the field and downstream mappings use the expected field name.

Cause

This issue can occur when:

• The Windows command-line audit policy is disabled or has not reached the endpoint.
• The raw Event 4688 record contains an empty command-line value.
• The WEF subscription format does not expose the expected rendered field data.
• A parsing or downstream transformation step removes or renames the field.

Additional Information

Compare a raw Event 4688 record from an affected endpoint with one from a working endpoint. If the raw record lacks command-line data, continue with Windows policy distribution. If it contains the data but the parsed event does not, investigate the Cribl parsing path.