Installation

Change auditor collect

ALLIACOM
New Member

hello every body ,

someone know how to configure splunk for collect change auditor logs please ?

Thansk in advance

Tags (1)
0 Karma

Richfez
SplunkTrust
SplunkTrust

I'd check your documentation - apparently there's a SIEM Integration Guide with a section on Integration with Splunk.

I'd need a login at the change auditor site in order to see the details (which you should have if you own the software), but the little that I see when I search their KBase tells me mostly what we need to know.

When searched for siem, https://support.quest.com/change-auditor/kb?k=siem, shows a couple of tidbits:

... to write Change Auditor audited events locally to a Windows event log.

And also

Select the subsystems to include in the subscription. Click Finish. For more information please see the "Managing a Splunk integration" section of the SIEM Integration Guide.

When you put those two together, I believe Change Auditor can record events into the Windows Event Log, and from there you can either collect them into Splunk via UF or WMI, or can use Event Log Forwarding (an MS thing) to move those logs to another system, from where you can collect them via UF or WMI.

But either way, that SIEM guide should get you started!

Happy Splunking!
-Rich

0 Karma

manish_singh_77
Builder

Hi Alliacom,

Pls refer the below link for more information, let me know if it works for you.

http://docs.splunk.com/Documentation/Splunk/6.1.4/Security/AuditSplunkactivity

0 Karma

ALLIACOM
New Member

Hi manish thank's for you answer but
i'm talking about dell change auditor logs and not splunk audit logs

0 Karma

manish_singh_77
Builder

Oh I see....

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...