topic Re: Regarding Absence of Windows Security Command Line Events in Logs in Getting Data In

Regarding Absence of Windows Security Command Line Events in Logs

AL3Z — Sun, 19 Nov 2023 11:18:57 GMT

hi ,

We could be the issue regarding the absence of Windows Security Command Line " EventCode=4688 ParentProcessName="C:\\Windows\\System32\\cmd.exe" events.
I have not blacklisted it in any of the app.

Thanks.

Re: Regarding Absence of Windows Security Command Line Events in Logs

bharathkumarnec — Tue, 14 Nov 2023 15:15:34 GMT

@AL3Z Can you may be run btool to check the full configuration?

Re: Regarding Absence of Windows Security Command Line Events in Logs

AL3Z — Thu, 16 Nov 2023 17:37:13 GMT

@bharathkumarnec

Hi, Where exactly we can run this btool to check the configurations. I dnt have back end access can we check in ui.

Re: Regarding Absence of Windows Security Command Line Events in Logs

bharathkumarnec — Fri, 17 Nov 2023 14:56:51 GMT

@AL3Z
$SPLUNK_HOME$/bin/splunk btool inputs list --debug

Re: Regarding Absence of Windows Security Command Line Events in Logs

AL3Z — Mon, 20 Nov 2023 11:36:10 GMT

@bharathkumarnec Hi,

After investigating I came across audit process creation is this causing this issue ??
https://docs.splunk.com/Documentation/ES/7.2.0/Admin/ConfigureLogging

Re: Regarding Absence of Windows Security Command Line Events in Logs

bharathkumarnec — Mon, 20 Nov 2023 11:42:41 GMT

@AL3Z please check if the source is generating the data in the event viewer with the information that you are looking ?

Re: Regarding Absence of Windows Security Command Line Events in Logs

AL3Z — Mon, 20 Nov 2023 13:43:11 GMT

@bharathkumarnec ,

Yes, it is generating the data in the event viewer!