topic Re: Heavy forwarder and sysmon in Splunk Search

Heavy forwarder and sysmon

verifi81 — Mon, 26 Jul 2021 04:23:46 GMT

Hello friends,

Suppose I install Microsoft Sysmon on a Windows server.

I then go install the Universal Forwarder on the Windows server with the default settings. A deployment server is in the mix too if that matters.

My question is this. Will the Universal Forwarder know to pick up the Syslog events if using all default settings? Is that defined on the Deployment server?

Re: Heavy forwarder and sysmon

venkatasri — Mon, 26 Jul 2021 04:39:09 GMT

Hi @verifi81

By default add-on having sysmon events disabled you shall deploy it UF either via DeploymentServer (DS) having it enabled. DS doesn't define anything it's the admin who supposed to enable it and put it on DS then whitelist the add-on to get deployed to UF that you wish to.

An upvote would be appreciated and Accept the solution if this reply helps!

Re: Heavy forwarder and sysmon

venkatasri — Mon, 26 Jul 2021 04:44:38 GMT

@verifi81 sysmon settings have been shared here FYI - Solved: Re: Connectivity issues - Splunk Community

An upvote would be appreciated if this reply helps!