topic How to capture Windows evtx files in Getting Data In

How to capture Windows evtx files

nls7010 — Thu, 27 Jun 2019 19:09:22 GMT

A customer has asked me to pick up the following logs:

%SystemRoot%\System32\Winevt\Logs\Application.evtx
%SystemRoot%\System32\Winevt\Logs\Security.evtx
%SystemRoot%\System32\Winevt\Logs\System.evtx

I am trying to figure out how to obtain those and have looked at a number of posts, but I'm not seeing what I'd like to do. Is the following possible? I want to create an inputs file as follows:

[WinEventLog://Application]
index = Winevt
sourceType = Winevt:Application
disabled = 0 
[WinEventLog://Security]
index = Winevt
sourceType = Winevt:Security
disabled = 0 
[WinEventLog://System]
index = Winevt
sourceType = Winevt:System
disabled = 0

But how does it know where to go for the actual files I want picked up?

Do I need to put in a full path to the logs (for instance d:/windows/events..../application.evtx)?

Any assist would be very helpful.

Re: How to capture Windows evtx files

mdsnmss — Wed, 30 Sep 2020 01:04:30 GMT

So Splunk doesn't monitor the files but the event log channels itself. You don't want the full path but use the built monitors like you have listed. Documentation on these are available here: https://docs.splunk.com/Documentation/Splunk/7.3.0/Admin/Inputsconf#Windows_Event_Log_Monitor. The add-on Splunk_TA_windows also has an inputs as well as other useful parsing for these logs you can use. That is available here: https://splunkbase.splunk.com/app/742/.

Re: How to capture Windows evtx files

richgalloway — Thu, 27 Jun 2019 20:28:14 GMT

Splunk knows where to find the event logs. Set the stanza name to WinEventLog://Application, WinEventLog://Security, or WinEventLog:System and Splunk will do the rest.

BTW, the conventional name for the Windows event sourcetypes is WinEventLog:*. Other names are allowed, but apps that process Windows events may not work without modification.

Re: How to capture Windows evtx files

tnesavich_splun — Wed, 30 Sep 2020 02:33:47 GMT

See link below for walkthough
https://www.cloud-response.com/2019/07/importing-windows-event-log-files-into.html

Key is to monitor evtx files using the special preprocess-event sourcetype on a windows instance of Splunk.

Takeaways:
1. Copy evtx to spare windows server
2. Load as many services as possible for known content (IE if evtx for AD load AD etc)
3. Install Splunk
4. Monitor directory with evtx files

NOTE
I did this on a Windows EC2 instance successfully, stopped Splunk on Windows EC2 instance and then copied the following over to my test instance of Splunk on my Mac to faster / more direct access to the parsed evtx:
SPLUNK_HOME/var/lib/splunk/wineventlog
SPLUNK_HOME/var/lib/splunk/wineventlog.dat