Fix WEF inputs for Splunk

Vagrant/resources/splunk_forwarder/wef_inputs.conf

@@ -384,6 +384,33 @@ start_from = oldest
 current_only = 0
 checkpointInterval = 5
 
+[WinEventLog://WEC7-Active-Directory]
+sourcetype = WinEventLog:Security
+source = WinEventLog:Active-Directory
+index=wineventlog
+disabled = 0
+start_from = oldest
+current_only = 0
+checkpointInterval = 5
+
+[WinEventLog://WEC7-Terminal-Services]
+sourcetype = WinEventLog:Security
+source = WinEventLog:Terminal-Services
+index=wineventlog
+disabled = 0
+start_from = oldest
+current_only = 0
+checkpointInterval = 5
+
+[WinEventLog://WEC7-Privilege-Use]
+sourcetype = WinEventLog:Security
+source = WinEventLog:Privilege-Use
+index=wineventlog
+disabled = 0
+start_from = oldest
+current_only = 0
+checkpointInterval = 5
+
 [monitor://c:\pslogs]
 index = powershell
 sourcetype = powershell_transcript