topic Re: Is it recommended to install Universal Forwarder on all Workstations? in Getting Data In

Is it recommended to install Universal Forwarder on all Workstations?

kiran331 — Wed, 15 Feb 2017 19:50:47 GMT

Is it the best way to install Universal Forwarders on all Workstations and enable windows security events , Right Now I have UF's on all DC's?

mpreddy — Wed, 15 Feb 2017 20:03:07 GMT

some thing related answer:

nickhills — Wed, 15 Feb 2017 20:24:06 GMT

If your asking "is there value" in installing the UF on workstations the answer is almost certainly "yes"

But you should consider a few things first:

Monitoring your DCs will show you failed/successful domain logins, but they may not include all the security relevant events, such as all attempts using local credentials or local file/device access.
With the UF on your workstations you can also start to monitor application logs, or with SplunkStream even wireline traffic for remote diagnostics etc.
But - you can easily start collecting huge amounts of data, so be sure your indexer disk (or your index management) has been spec'd to cope - and most importantly consider the size of your licence!