Hi All,
We're considering turning off by default the Windows Filtering Platform events from the Security Log that tend to make a whole lot of noise for no really good reason. The only problem we have with this is our policy to date has been "we capture 100% of the Security Log" and we know some people may have legit reasons for using them. Our experience in support, though, tells us that most everyone is happy with turning them off and never seeing them again. We would provide coverage in a second connector, something you could easily enable for many systems using connector profiles (or individually for each system you needed it on).
Do you use Windows Filtering Platform Events? On which systems? What do you use them for? What if we turned them off by default?