Add KAPE-parsed Eventlog records to the Eventlog Dashboard

[MTekinAU]

Hi, I can see the kape logs when I select kape-* from data views dropdown under Discover section, but I cannot see anything under Eventlog Dashboard.

[philhagen]

ah good observation. The Eventlog Dashboard does not currently pull data from the kape-* indices. That's a great improvement idea, though. It would take some work to get there, but I'll leave this issue open to track progress toward that goal.

[philhagen]

also adding a note that we now have Eventlog data from Plaso as well, so we'll need to incorporate those too.

[Ph4Yk]

Hi there, just to add on to this, previously, before a kape-* data view was added, kape-parsed logs would distribute between all relevant dashboards i.e EventLog, LNK and NTFS Dashboards. Now with the introduction of the new data view they all populate only the kape-* data view meaning the dashboards receive no data.