Windows Forwarded Events connector with Windows Security Events NRT rules

Yes—this behavior is expected for these specific templates. Your WEC/WEF, Arc, and AMA path is working because forwarded records reach WindowsEvent, while Windows Security Events via AMA writes to SecurityEvent. An NRT rule evaluates only the tables referenced by its KQL, so a template starting with SecurityEvent cannot detect event 1102 or 4732 stored in WindowsEvent; the connector itself is not failing.

Create a custom NRT rule based on the template logic, query WindowsEvent, filter EventID, and project only fields needed for alerts and entity mappings. For 4732, inspect EventData and map the member and group values present in your records. Test against recent events, enable the rule, then prevent duplicate detections. If you require the unchanged SecurityEvent templates, collect the source machines through Windows Security Events via AMA. Use an ASIM-based template only when its documented parser and schema explicitly support these records; ASIM is not an automatic bridge.