Picking which logs to monitor

[mmcap]

When monitoring Windows systems which logs do you find to give the best information for finding security events and then tracking down the event from start to finish?

[gcusello]

Hi @mmcap ,

uing the Splunk Ta Windows (https://splunkbase.splunk.com/app/742) you can monitor many things on a windows devoce (server or cliente).

If you have security requisites, the first data source should be wineventlog:security.

But there are many other sources that could be interesting.

As I said, open the Add-On and see the possible inputs you have so you can choose the one you could require.

Ciao.

Giuseppe

[mmcap]

Hi Giuseppe,

I appreciate the lightning fast answer and I agree, there is a multitude of  logs to choose from. That's kind of the problem. 

I will most certainly look at the link you supplied but I was trying to find out which logs other people feel work best for them. 

In the mean time I will have a look around the content on your link.

Ciao

Norm 

[gcusello]

Hi @mmcap,

as I said, you can start from the wineventlog:security logs that contain the most information useful for security, then you could take processes, to identify if there's some rogue process, open ports and local admins.

I usually enable all the logs, eventually disabling only the performace monitoring because it's very verbose and (for this reason) expensive (in terms of license).

Ciao.

Giuseppe

[isoutamo]

Hi

Here is Splunk's InfoSec app, which you can look and thing what are those panels which are important to you. Based on that you can check which logs are needed to fulfil those.

https://splunkbase.splunk.com/app/4240

Very easy to setup and use, but still you will get lot of information what is happening.

r. Ismo