Process Creation Alerts Triggered by Splunk Universal Forwarder on Windows

farrukh_majid — Fri, 27 Dec 2024 08:08:34 GMT

Hello,

After deploying the Splunk Universal Forwarder on a Windows machine, I am observing repeated process creation alerts being triggered by my security monitoring solution. These alerts are specifically related to the following Splunk processes:

splunk-winevtlog.exe
splunk-admon.exe
splunk-powershell.exe
splunk-monitornohandle.exe
splunk-regmon.exe
splunk-netmon

These processes are essential for log collection and monitoring, but the constant alerts are causing noise in our monitoring system.

I would appreciate any advice or recommended best practices to handle this issue. Specifically:

Are there standard configurations or exclusions that can be applied to suppress alerts for these legitimate processes?
What steps can be taken to ensure the forwarder operates as intended without raising unnecessary security flags?

Re: Process Creation Alerts Triggered by Splunk Universal Forwarder on Windows

marnall — Fri, 27 Dec 2024 20:08:41 GMT

Usually people safelist the SplunkForwarder service and the entire SplunkForwarder directory. You could safelist individual services and apps but you may end up spending lots of time playing whack-a-mole.

You may be able to look through the community forums and Splunk Slack usergroup for your particular EDR solution to see if others have specific tips applying to that EDR.

topic Re: Process Creation Alerts Triggered by Splunk Universal Forwarder on Windows in Feedback

Process Creation Alerts Triggered by Splunk Universal Forwarder on Windows

Re: Process Creation Alerts Triggered by Splunk Universal Forwarder on Windows