topic Re: Splunk Windows network information in Getting Data In

Splunk Windows network information

joe06031990 — Sun, 17 Jan 2021 11:59:41 GMT

Hi,

I have a Splunk instance on Linux and I am trying to get windows network information from a IIS web server for example Port number,Protocol and IP address. I can get it to work on a windows instance just not from Linux not sure if it uses WMI just wondered if it was possible or would it need to be a powershell script?

Thanks

Joe

Re: Splunk Windows network information

gcusello — Sun, 17 Jan 2021 16:52:56 GMT

Hi @joe06031990,

you have to:

install a Splunk Universal Forwarder on one or all the Windows targets;
on these UFs install e.g. the Splunk_Windows_TA (https://splunkbase.splunk.com/app/742/) that contains all the windows inputs: wineventlog, ps scripts, files, etc...;
then, you can add more inputs (in the same TA or in a different one) to take the IIS logs and all the things you need, also other PS scripts.

Ciao.

Giuseppe

Re: Splunk Windows network information

joe06031990 — Sun, 17 Jan 2021 17:56:57 GMT

Hi, I have done the bellow and can get all apart from the network logs for ports,up addresses, ETC the only network details I see are bytes in/out.

thanks

Joe

Re: Splunk Windows network information

gcusello — Sun, 17 Jan 2021 18:05:12 GMT

Hi @joe06031990,

Are you using Splunk TAs or custom inputs?

Did you tried the Splunk Add-On for Microsoft IIS (https://splunkbase.splunk.com/app/3185/#/overview)?

Ciao.

Giuseppe

Re: Splunk Windows network information

joe06031990 — Sun, 17 Jan 2021 18:24:38 GMT

Hi,

I have Splunk TA,IIS and Windows infrastructure app installed.

thanks

joe

Re: Splunk Windows network information

gcusello — Sun, 17 Jan 2021 18:28:35 GMT

Hi @joe06031990,

if the information that you can have from those TAs aren't sufficient for your needs, the only way is to write your own scripts to insert in a custom TA.

Ciao.

Giuseppe

Re: Splunk Windows network information

joe06031990 — Sun, 17 Jan 2021 19:39:30 GMT

I've added:

[WinNetMon://test]
addressFamily = ipv4;ipv6
direction = inbound;outbound
host = WIN-PIDFR5LUJC6
packetType = connect;accept
protocol = tcp;udp

works fine now, Thanks for your help.

Re: Splunk Windows network information

gcusello — Sun, 17 Jan 2021 20:19:01 GMT

Hi @joe06031990,

good for you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉