topic Re: WEC-EventCollector add permanent field to sourcetype search in Splunk Search

WEC-EventCollector add permanent field to sourcetype search

zach-keener — Wed, 06 Mar 2024 16:48:58 GMT

How would I add a permanent search or field to a sourctype?
For example: I have a set of a data that I have been able to snag a field out of using this search

sourcetype="collectedevents" | rex field=_raw "<Computer>(?<Computer>[^<]+)</Computer>"

Our sourcetype is "collectedevents"

And I found the way to pull the <Computer> field that was in the XML data down to a field "Computer"

But what I would like to be able to do is to have that field be permanent, or transpose the "host =" to not be the host of the WEC but the host of the origin server that it came from.

Long story short, we have servers that we don't want the Splunk Forwarder on because we know that it can execute scripts creating a vulnerability with the Splunk Forwarder on these servers. Any help is appreciated, thank you!

Re: WEC-EventCollector add permanent field to sourcetype search

marnall — Sun, 10 Mar 2024 19:34:48 GMT

This can be done by adding a props and transforms config file on the indexer machines. As an example, you could push an app to your indexers with:

/<appname>/local/props.conf

containing:

[collectedevents] # change_host and changehostfield are arbitrary values. Change how you like TRANSFORMS-change_host = changehostfield

-and-

/<appname>/local/transforms.conf

containing:

# Stanza name must match whatever you set the "changehostfield" value in props.conf [changehostfield] DEST_KEY = Metadata:Host # Add your regex below REGEX=<Computer>([^<]+)<\/Computer> FORMAT = host::$1

Then the indexers should replace the host field with the value in the XML <Computer> field

Re: WEC-EventCollector add permanent field to sourcetype search

PickleRick — Sun, 10 Mar 2024 20:34:37 GMT

1. If you can get the events in XML into your Splunk, you can just use the default xml windows event format from TA_windows. Unfortunately it's not that easy with third party tools (there are some of them which are supposed to be able to do it but I've never tested it)

2. If you use WEF, why not use UF on the collector host?

3. Using regex on structured data is not the best idea.