topic Netwrix TA in Getting Data In

Netwrix TA

Okezie1 — Tue, 26 Oct 2021 16:58:30 GMT

Has anyone ever installed the Netwrix addon in Splunk? Having a bit of trouble with how to do so.

Re: Netwrix TA

acadea — Fri, 19 Nov 2021 14:04:23 GMT

can you provide a link to that addon, I'm not able to find it on splunkbase.

or perhaps you're talking about the netwrix addon for splunk which is a powershell script that is writing netwrix events to windows event log so that splunk ufw can collect it ?

Re: Netwrix TA

Okezie1 — Fri, 19 Nov 2021 14:39:05 GMT

There is no Splunkbase TA. I'm referring to the Netwrix addon for Splunk which is a PowerShell script.

Re: Netwrix TA

acadea — Fri, 19 Nov 2021 14:49:26 GMT

yes, I've configured the netwrix powerhsll script to be executed as a scheduled task .
- also enabled the API on Netwrix ( see settings, API)
- configured splunk UFW to collect the windows event log netwrix_integration_bla_bla

what is the blocking point for you?

Re: Netwrix TA

Okezie1 — Fri, 19 Nov 2021 14:54:56 GMT

We were able to create a deployment app on our Heavy Forwarder, created a serverclass as well, and customized the inputs.conf to grab the Winevent logs. However, the client stated that they were only receiving general audit information that showed who logged in, etc but didn't receive the actual log information.

https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/MonitorWindowseventlogdata#Monitor_Windows_event_log_data_with_Splunk_Cloud_Platform

This is the link we used to assist.

Re: Netwrix TA

acadea — Fri, 19 Nov 2021 15:22:44 GMT

who logged in... where ? on Netwrix ? on Windows/AD ?

there are 3 Netwrix generated eventlogs on Windows

[WinEventLog://Netwrix Auditor] - > this is the same EventLog that you can see in Netwrix interface regarding events related to data collection etc

[WinEventLog://Netwrix Auditor Security] - > this is containing Netwrix on Netwrix audit, that is who has started Netwrix, what changes were done in the Netwrix interface, etc. Netwrix Auditor Self-audit let's say. I suppose this is what you're describing as currently collected.

[WinEventLog://Netwrix_Auditor_Integration] - > this is what you're after. It should have this format:

08/24/2021 09:56:37 AM
LogName=Netwrix_Auditor_Integration
SourceName=Netwrix_Auditor_Integration_API
EventCode=35940
EventType=4
Type=Information
ComputerName=srv-01
TaskCategory=492
OpCode=Info
RecordNumber=41188878
Keywords=Classic
Message=
DataSource : Windows Server
Action : Modified
Message: Modified System Time
Where : srv-01
ObjectType : System Time
Who : NT AUTHORITY\SYSTEM
What : System Properties\System Time
When : 2021-08-24T07:36:22Z
Workstation :
Details : System time changed from "2021-08-24T07:36:08.173840600Z" to "2021-08-24T07:36:22.192000000Z"

Re: Netwrix TA

Okezie1 — Fri, 19 Nov 2021 15:38:12 GMT

My apologies, it was the Netwrix Auditor Security I was referring to.

Re: Netwrix TA

acadea — Fri, 19 Nov 2021 15:41:28 GMT

well, collect the other eventlog and maybe that will solve your problem ?

Re: Netwrix TA

Okezie1 — Fri, 19 Nov 2021 15:59:11 GMT

I'll add the [WinEventLog://Netwrix Auditor] and [WinEventLog://Netwrix_Auditor_Integration] stanzas as well and see what we're able to pull.