topic Re: Windows Logs in Endpoint data model in Knowledge Management

Windows Logs in Endpoint data model

sinhashubham014 — Mon, 11 Dec 2023 07:16:21 GMT

Hello, i am deploying the ESCU searches in our environment. However, the endpoint logs are not ingested in Splunk. However for deploying the usecases, I ingested the Windws Security Logs with win event 4688/4689 to monitor the usecases. Sysmon logs are not ingested well. The Windows logs, configured with endpoint model are triggering the notables. Is it triggered notables relevant with the incident triage?

Re: Windows Logs in Endpoint data model

gcusello — Mon, 11 Dec 2023 07:43:24 GMT

Hi @sinhashubham014,

I suppose that you are using the Splunk_TA_Windows on the Search Head for parsing.

Anyway, log ingestion isn't managed by ESCU: ESCU contains many Correlation Searches to use in ES or simply in Splunk Enterprise, no parsing or ingesting rules.

See if you are correctly parsing your logs and if there are the eventtypes to assign the correct tagging to your logs, so the DataModels are correctly populated.

Ciao.

Giuseppe

Re: Windows Logs in Endpoint data model

sinhashubham014 — Mon, 11 Dec 2023 08:03:01 GMT

I have configured the Endpoint data model logs with windows:security, system and registery logs. However, when i triggered the ESCU usecases, it's showing the events.

Re: Windows Logs in Endpoint data model

gcusello — Mon, 11 Dec 2023 09:05:04 GMT

HI @sinhashubham014 ,

which ESCU Use Cases are triggered?

Why isn't the result you want?

Ciao.

Giuseppe