DC Logs are partially getting ingested to secops

I've not personally seen that issue. Its only a certain category of log? Can you email support@bindplane.com and open a ticket? 

Hi,
From my experience, I believe the issue you described is not related to BindPlane or SecOps.
A single WEC server typically doesn't have the capacity to collect logs from 20 AD servers — that’s a significant volume of data.

You can confirm this assumption by simulating an event from an AD server and checking whether it appears in the local server’s Event Logs, specifically under the Forwarded Events section on the WEC server.
If the event does not appear there, it indicates that the issue lies in the log forwarding process between your Windows servers — and therefore, the event will not be ingested into BindPlane.

I highly recommend reviewing this stage before checking log ingestion at the BindPlane or SecOps level.

I usually resolve this issue for clients by following these steps:

1.In the WEC configuration, change the log collection method to source-initiated instead of collector-initiated.

2. Deploy additional WEC servers and distribute the load between them (this can be controlled via Windows GPO).
If the two previous steps are not an option, consider installing an agent on each server.

I am having a very similar issue, once we migrated to bindplane running on the WEC and collecting directly from the custom channel. We noticed a huge drop in ingestion.