topic Re: [WinEventLog://Security] logs to Splunk in Getting Data In

[WinEventLog://Security] logs to Splunk

Murali — Mon, 03 Jul 2023 03:02:37 GMT

Hello guys,

I have [WinEventLog://Security] inputs.conf setup.

However , I would like to see the machine/server type and OS type in the index which is currently not there.

How can I bring this data in. I have checked the raw data and no such infomation.

Your thoughts? Thanks in advance.

Cheers..

Regards

Re: [WinEventLog://Security] logs to Splunk

venkatasri — Mon, 03 Jul 2023 04:42:50 GMT

Hi @Murali

If you can't find Type/ OS in Windows Security Event logs that are ingested to Splunk, that is likely due to the source windows machines do not have such information exist in event logs.

You could talk to Windows Administrator to include the desired details on Windows machine that you wanted for Splunk to collect and ingest.

Hope this helps!

-------------------------

Srikanth Yarlagadda.

Re: [WinEventLog://Security] logs to Splunk

Murali — Mon, 03 Jul 2023 06:33:27 GMT

Thanks for the suggestion Sri. Will try it out.

Cheers..

Regards

Murali

Re: [WinEventLog://Security] logs to Splunk

PickleRick — Mon, 03 Jul 2023 07:32:19 GMT

As @venkatasri already pointed out - you can't just conjure data out of thin air - if the original event doesn't include the information (and typically it doesn't - why should it? You don't need the extra amount of wasted storage only to have the information which you typically should have otherwise).

And your windows admin will most probably _not_ be able to force windows to include such info in the logs (again - why should windows send that in the event?).

Typically, in all kinds of monitoring software you usually have some form of an asset database separate from the events themselves and a method of correlating the source identified from the event with the data in said database. In case of plain Splunk Enterprise you can gather such info in a lookup table and dynamically enrich your data on search. If you have Enterprise Security, there are additional options of having such asset db created (semi-)automatically for you.