topic Re: Can WinEventLog populate the Endpoint datamodels? in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/Can-WinEventLog-populate-the-Endpoint-datamodels/m-p/484478#M7943 <P>Yes, and you can use this to help:</P> <P><A href="https://github.com/aholzel/SA-ESS-Windows">https://github.com/aholzel/SA-ESS-Windows</A></P> <PRE><CODE>Splunk App for Enterprise Security and Windows Security log Purpose of the app is: Fix things the default Splunk Windows apps break Fill the Enterprise Security Datamodels </CODE></PRE> <P>.</P> Sun, 01 Mar 2020 18:59:07 GMT spayneort 2020-03-01T18:59:07Z Can WinEventLog populate the Endpoint datamodels? https://community.splunk.com/t5/Splunk-Enterprise-Security/Can-WinEventLog-populate-the-Endpoint-datamodels/m-p/484477#M7942 <P>We wonder whether the WinEventLog can be applied to the Endpoint datamodels.</P> <P>It seems to us that -</P> <P>Endpoint.Process fits greatly win event id 4688 (A new process has been created). <BR /> Endpoint.Service could be populated with win event ID 4697 (A new service was installed)</P> <P>However <A href="https://docs.splunk.com/Documentation/WindowsAddOn/7.0.0/User/SourcetypesandCIMdatamodelinfo">Source types for the Splunk Add-on for Windows</A> lists for the CIM data models -<BR /> Application State, Authentication, Change Analysis, Performance, Updates and Vulnerabilities, while Application State is listed as deprecated. </P> Sun, 01 Mar 2020 00:56:15 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Can-WinEventLog-populate-the-Endpoint-datamodels/m-p/484477#M7942 danielbb 2020-03-01T00:56:15Z Re: Can WinEventLog populate the Endpoint datamodels? https://community.splunk.com/t5/Splunk-Enterprise-Security/Can-WinEventLog-populate-the-Endpoint-datamodels/m-p/484478#M7943 <P>Yes, and you can use this to help:</P> <P><A href="https://github.com/aholzel/SA-ESS-Windows">https://github.com/aholzel/SA-ESS-Windows</A></P> <PRE><CODE>Splunk App for Enterprise Security and Windows Security log Purpose of the app is: Fix things the default Splunk Windows apps break Fill the Enterprise Security Datamodels </CODE></PRE> <P>.</P> Sun, 01 Mar 2020 18:59:07 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Can-WinEventLog-populate-the-Endpoint-datamodels/m-p/484478#M7943 spayneort 2020-03-01T18:59:07Z