Filtering them out reduces the indexing and retention load. The specific items outlined in the WinEventLog://Security blacklist items correspond to items of low value but high volume. This is a best practice approach for filtering because it avoids load otherwise put on the network and indexers to process and discard the events. blacklist items are used to filter matching Windows events at the forwarder.English event logs is a dependency for dependent apps and add-ons to parse fields and work correctly. Setting renderXml = true is a best practice because the resulting data is always in English even if the endpoint's Window installation is not English. This readability is critical given that parsing individual events is necessary while investigating a security incident. XML is more structured format than the white space delimited default raw text produced by Windows. The default in Splunk Enterprise is 'false' although users of the Splunk® Add-on for Windows may notice the add-on sets the value to true. renderXml renders Event Log data as XML in English.Beyond that is a notable setting used by all input types, the index setting. This material explains their relevance while the Use nf to configure event log monitoring documentation elaborates on these settings, as well as many others. īlacklist1 = EventCode="4662" Message="Object Type:\s+(?!groupPolic圜ontainer)"īlacklist2 = EventCode="566" Message="Object Type:\s+(?!groupPolic圜ontainer)"īlacklist3 = EventCode="4688" Message="New Process Name: (?i)(?::\Program Files\Splunk(?:UniversalForwarder)?\bin\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi)).exe)"Ī few of the settings used in the above template are specific to the WinEventLog input type. Those using the configuration file approach can copy and paste the configuration template from below into the appropriate nf file such as Splunk_TA_windows-mine/local/nf. Those using Splunk Web can use the instructions already available in the documentation Use Splunk Web to configure event log monitoring. You'll create the following simplified configuration regardless of your implementation method. If you're unfamiliar with the add-on, see our related post Is it a best practice to use the Splunk Add-on for Microsoft Windows? Alternatively, those interested in Deploying and Using the Splunk Add-on for Windows may prefer to Use nf to configure event log monitoring. An excellent way to implement this is to Use Splunk Web to configure event log monitoring. Use WinEventLog data inputs to collect all Windows Event Logs. To filter noisy and low value event logs, we'll focus specifically on the Security, Application, and System channels with some specific blacklist filters. But before you turn on the flood gates to collect all Window events, recognize there are hundreds of different event codes and such an approach can prove too noisy to be effective. The Monitor Windows event log data documentation explains why Windows Event Log data is a critical provider of security-relevant data. This topic provides the relevant knowledge to understand the Splunk configuration details in this post. If you're new to collecting Windows endpoint Event Log data with Splunk, then review Monitor Windows event log data in the Getting Data In Manual. Read more about How Crowdsourcing is Shaping the Future of Splunk Best Practices. The Splunk Product Best Practices team provided this response.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |