monitor security windows events with syslog

LiorG — Wed, 27 Jan 2021 09:43:55 GMT

hi there,

i monitor windows security event log from the DC with RAW SYSLOG.

i can see in Splunk the raw data (without the default Syslog RFC's) also i can see that the data as xml view.

When i downloaded the Splunk add on for windows i configured the WinEventLog source type to my UDP data input (where only windows security event log from the DC is delivered)

i can see that the fields are extracted with the XML headers

example:

System.EventId
EventData.LogonType

I Can only Receive syslog

thanks in advance

topic monitor security windows events with syslog in Getting Data In

monitor security windows events with syslog