All Apps and Add-ons

TA-Microsoft-Sysmon field extraction issues

neerajs_81
Builder

Gentlemen,
We are using  https://splunkbase.splunk.com/app/1914/
 Splunk is not extracting all the fields visible in the Windows Sysmon events. It leaves out lot of fields.   

This is what i suspect is the cause, but need someone to advise if i am on the right track.
In the events, the SourceType shows as: WinEventLog:Microsoft-Windows-Sysmon/Operational

neerajs_81_0-1647876278270.png

 

However, On my Search Head when i go to Settings >> SourceTypes >> ALL , i see a different name:   XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

There is no source type here by the name of WinEventLog:Microsoft-Windows-Sysmon/Operational

neerajs_81_1-1647876278287.png

 

Is the conflict of different sourcetype names causing the issue ?  What needs to be done to fix ?

Things i tried...

1.  Added the following in inputs.conf to make it format as per XML

 

[WinEventLog://Microsoft-Windows-Sysmon/Operational]
renderXML=true
sourcetype=XMLWinEventLog:Microsoft-Windows-Sysmon/Operational 

 


This did extract all the fields but ended up showing the  events in XML format .  How can i keep the default /original format of displaying Windows events yet make it extract all the fields ?

Thanks all

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You made two changes, renderXML and sourcetype, and got two results - fields extracted and XML format.  I believe the field extraction is the result of changing the sourcetype.  Changing renderXML back should fix the XML problem.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

neerajs_81
Builder

Thank you.  Ended up being as simple as what you suggested 🙂 😀

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you tried setting renderXML = false?

---
If this reply helps you, Karma would be appreciated.

neerajs_81
Builder

Thanks for responding.  Earlier I was trying without mentioning the renderXml parameter at all in my input.conf, as it's default value is false. But that did not solve the original problem. 

Meaning it does display the events in regular Windows event format as we are used to but  does not extract all fields. About Less than 10 fields are extracted.

On the other hand If we make the events render as xml then all fields get extracted successfully. 

Wonder if this is how the TA for sysmon works? Is it by design ? 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You made two changes, renderXML and sourcetype, and got two results - fields extracted and XML format.  I believe the field extraction is the result of changing the sourcetype.  Changing renderXML back should fix the XML problem.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...