topic Universal Forwarder and AppLocker Events XML in Getting Data In

Universal Forwarder and AppLocker Events XML

pirsa — Tue, 07 Aug 2018 05:14:22 GMT

Hey Guys trying to toubleshoot an issue here. Trying to get the XML events from the UF on Windows machines into splunk.

The normal

[WinEventLog://Microsoft-Windows-AppLocker/EXE and DLL]

seems to work, but for some reason if I change to get the extended xml version of

[XmlWinEventLog://Microsoft-Windows-AppLocker/EXE and DLL]

it does not send anything through to the indexer.

I am wondering if there is maybe a setting in windows preventing the splunk UF from obtaining the XML exports of the events? anyone able to shed some light on this?

Re: Universal Forwarder and AppLocker Events XML

jeremyhagand61 — Mon, 20 Jan 2020 03:31:46 GMT

Add renderXml=true to your stanza

Re: Universal Forwarder and AppLocker Events XML

Flo-Paris — Thu, 27 May 2021 15:10:48 GMT

Hello,

Did you find a solution ? i have the same issue, i dont know how to get in my splunk the xml part of the eventlog where the most useful information (file signature, full file path, etc...) are concerning AppLocker...

Any help ?

thanks,

Florent

Re: Universal Forwarder and AppLocker Events XML

Flo-Paris — Thu, 27 May 2021 15:11:10 GMT

Re: Universal Forwarder and AppLocker Events XML

Flo-Paris — Thu, 27 May 2021 15:11:24 GMT