How to get data from Sysmon into Splunk ?

[katy27]

I have successfully installed sysmon. I have confirmed that sysmon is running in event viewer (Application and Service Logs > Microsoft > Windows > Sysmon > Operational).

I downloaded and installed the TA-microsoft-sysmon on the search head I use.
I also copied the TA-sysmon folder to the deployment server (\Splunk\etc\deployment-apps\TA-microsoft-sysmon) and then deployed it to my UF running on my test host.

What is the next step to do ? How can i add the data to splunk ?

[larchinal75]

Good morning,

I have experience with Sysmon as well as a little experience with Splunk and I have configured it multiple ways.

1) I had a x1 computer that I installed Sysmon and Splunk on for initial testing and due to lack of hardware. Once I installed Sysmon, I followed this path: Windows Logs -> Applications and Services Logs -> Microsoft -> Windows -> Sysmon -> Operational. I highlighted Operational and right-clicked then selected the properties option. At that point you can view the Full Name fields and the Log Path field. I found the best way to ingest logs at this point with my setup was to change Sysmon's Log Path to %SystemRoot%\System32\Winevt\Logs\ForwardedEvents.evtx, which enabled Sysmon logs to be stored in the Forwarded Events. In Splunk I then configured a local windows connector to begin ingesting the logs.

2) I had x1 Windows workstation and x1 Windows Server that also had splunk on it. I configured it this way once I gained more hardware and for content development. I never had the goal of enterprise log ingestion, but this solution could still work: I followed these instructions to install Sysmon, enable Windows Event Collection, and Windows Event Forwarding.
https://natesec.com/configuring-windows-event-forwarding-with-sysmon/

Once the subscription was set up and I had logs moving from my workstation to the server, I once again used the local Splunk connector to ingest logs into Splunk from my server. Once again the local Splunk connector would ingest forwardedEvent logs without having to use other types of forwarders or downloading extra apps.

I hope this helps!

Resources:
https://natesec.com/sysmon-to-splunk/
https://natesec.com/configuring-windows-event-forwarding-with-sysmon/

[p_gurav]

You can refer:

https://www.splunk.com/blog/2014/11/24/monitoring-network-traffic-with-sysmon-and-splunk.html
https://medium.com/@smurf3r5/splunking-with-sysmon-c321fe87c567

[mhammadkassem]

hello I was reading about how to configure sysmon to feed splunk with its logs and I reached this page, knowing that Im new to both splnk and sysmon , I tried to check the 2 links in the answer above but still its not clear to me! first link says that to get data from sysmon to splunk you need to configure a certain file (easy and sweet) however the second link says that there is an add-on to be installed at splunk, but unfortunately I didn't find this add-on. I hopefully want t complete and detailed guide of how to get data from sysmon into splunk.