Dashboards & Visualizations

Ingesting same Windows log with two different input stanzas

dkarbowski
Engager

I am collecting Sysmon logs via Splunk UF in XML format (renderXml=true). I need to forward some specific Sysmon events to QRadar without XML formatting. I would like to keep sending all Sysmon events in XML format to Splunk.

I tried to make two different stanzas in inputs.conf trying to ingest the same log in two different ways but it does not seem to work.

It looks like Splunk merge these two together in runtime.

The idea was to filter non-XML events on HF by using props.conf, transforms.conf and _SYSLOG_ROUTING to send it to QRadar.

[WinEventLog://Microsoft-Windows-Sysmon/Operational]
disabled = 0
renderXml = true
index = sysmon

[WinEventLog://Microsoft-Windows-Sysmon/Operational]
disabled = 0
renderXml = false
index = sysmon
whitelist = 1,22
0 Karma
1 Solution

bandit
Motivator

Spitballing...

  1. Possibly two forwarders on the same host and put one rule on each forwarder?
    https://www.splunk.com/en_us/blog/tips-and-tricks/running-two-universal-forwarders-on-windows.html

  2. Collect remotely using WMI and let a Heavy Forwarder route to QRadar https://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWindowseventlogdata#Use_WMI

  3. Write code to query the data from the Splunk REST API, reformat message, and post to to QRadar https://docs.splunk.com/Documentation/Splunk/latest/RESTUM/RESTusing

  4. PowerShell script to periodically query events and either write to a new log, post to Splunk HTTP Event Collector, or directly to QRadar https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?vie... https://docs.splunk.com/Documentation/Splunk/latest/Data/HECExamples

  5. Splunk Data Stream Processor https://www.splunk.com/en_us/software/stream-processing.html

View solution in original post

jamesjarrett
Path Finder

Look into "CLONE_SOURCETYPE"? or maybe this here. sorry for the hit n run...
https://community.splunk.com/t5/Getting-Data-In/How-can-I-use-CLONE-SOURCETYPE-to-send-a-cloned-modi...

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @dkarbowski,
you could try to create a symbolic link and use the second stanza pointing to the symbolic link file.
I'm sure of this solution on Linux because I used it, I never tested it on Windows!

Ciao.
Giuseppe

0 Karma

woodcock
Esteemed Legend

That would work for a file, which this is not.

woodcock
Esteemed Legend

Not possible. You will need to install the UF twice in order to accomplish this.

0 Karma

bandit
Motivator

Spitballing...

  1. Possibly two forwarders on the same host and put one rule on each forwarder?
    https://www.splunk.com/en_us/blog/tips-and-tricks/running-two-universal-forwarders-on-windows.html

  2. Collect remotely using WMI and let a Heavy Forwarder route to QRadar https://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWindowseventlogdata#Use_WMI

  3. Write code to query the data from the Splunk REST API, reformat message, and post to to QRadar https://docs.splunk.com/Documentation/Splunk/latest/RESTUM/RESTusing

  4. PowerShell script to periodically query events and either write to a new log, post to Splunk HTTP Event Collector, or directly to QRadar https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?vie... https://docs.splunk.com/Documentation/Splunk/latest/Data/HECExamples

  5. Splunk Data Stream Processor https://www.splunk.com/en_us/software/stream-processing.html

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...