topic Re: Windows Security events not getting forwarded in Splunk Search

Windows Security events not getting forwarded

srinivas_gowda — Wed, 20 Oct 2021 07:23:12 GMT

Hello team,

I am trying to monitor windows event logs and have installed the universal forwarded with relevant data. I am getting the Application and System logs, however the Security events are not being forwarded. I am adding the inputs.conf details below please let me know what is causing this.

###### OS Logs ######
[WinEventLog://Application]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
# only index events with these event IDs.
whitelist = 16350-16400
index = default_tier1_idx
renderXml=false

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
# only index events with these event IDs.
whitelist = 0-10000
index = default_tier1_idx
renderXml=false

[WinEventLog://System]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
# only index events with these event IDs.
whitelist = 7000-7050
index = default_tier1_idx
renderXml=false

Thank you

Re: Windows Security events not getting forwarded

PickleRick — Wed, 20 Oct 2021 08:56:35 GMT

What user are you running your UF with? Local System? Or any other user?

Do you get any errors in your UF's log?

Re: Windows Security events not getting forwarded

srinivas_gowda — Wed, 20 Oct 2021 09:16:41 GMT

Running this as a splunk user

Re: Windows Security events not getting forwarded

PickleRick — Wed, 20 Oct 2021 09:43:01 GMT

OK. So you're using a designated user, created specificaly for the installation of UF, right? This user most probably does not have sufficient permissions to read the Security Event Log.

The easiest way to grant this user privileges to read all event logs is to add it to the "EventLog readers" local group. But it gives the rights to read ALL event logs which in your case might not be what you want. In order to selectively grant permissions to single event logs, you have to fiddle with registry entries and SDDL (ugly as hell, I admit) - https://docs.microsoft.com/en-us/troubleshoot/windows-server/group-policy/set-event-log-security-locally-or-via-group-policy