Getting Data In

Connectivity issues

vijaysri
Contributor

Hi,

In Sandpit --> I have a multicluster environment created for testing

I have Windows Universal Forwarder --> From where I need to send sysmon logs to splunk

sysmon is successfully installed --> logging is enabled

In windows UF --> I have created inputs.conf and outputs.conf under Program Files --> SplunkUniversal forwarder--> etc--> system --> local

inputs.conf

[monitor://%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx]

index = main
sourcetype = web

 

outputs.conf

[tcpout]
defaultGroup=sysmon_server

[tcpout:sysmon_server]
server=FQDN:5986

 

Restarted the splunk

Added port 5986 into Heavy Forwarder of the clustered environment (9997 and 9998 ports were not getting connected to used 5986)

Index and sourcetype mentioned above are already there in HF.

--> Telnet is working

--> Phonehome logs are there

But sysmon logs are not getting ingested into splunk

 

0 Karma
1 Solution

venkatasri
Motivator

Hi @vijaysri 

sysmon add-on having it's own inputs to be configured as below that pulls logs automatically. Your explicit monitor does not work as .evtx files are binary.

Try following settings in inputs conf, same you can find in default/ dir of add-on.

[WinEventLog://Microsoft-Windows-Sysmon/Operational]
disabled = true
renderXml = 1
source = XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
# Prevent forwarding of multiple DNSQuery logs based on complex rule groups
# blacklist1 = EventCode="^22$" Message="(?i)QueryName:\s+(.*\.arpa\.)\s+QueryStatus:\s+(\d+)\s+QueryResults:\s+(.*)\s+Image:\s+(c:\\windows\\sysmon\.exe)$"
# blacklist2 = EventCode="^22$" Message="(?i)QueryName:\s+(HelloWorld.local)\s+QueryStatus:\s+(\d+)\s+QueryResults:\s+(.*)\s+Image:\s+(c:\\windows\\system32\\ping\.exe)$”

  ---

An upvote would be appreciated and Accept solution if this reply helps!

View solution in original post

Tags (1)
0 Karma

venkatasri
Motivator

Hi @vijaysri 

sysmon add-on having it's own inputs to be configured as below that pulls logs automatically. Your explicit monitor does not work as .evtx files are binary.

Try following settings in inputs conf, same you can find in default/ dir of add-on.

[WinEventLog://Microsoft-Windows-Sysmon/Operational]
disabled = true
renderXml = 1
source = XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
# Prevent forwarding of multiple DNSQuery logs based on complex rule groups
# blacklist1 = EventCode="^22$" Message="(?i)QueryName:\s+(.*\.arpa\.)\s+QueryStatus:\s+(\d+)\s+QueryResults:\s+(.*)\s+Image:\s+(c:\\windows\\sysmon\.exe)$"
# blacklist2 = EventCode="^22$" Message="(?i)QueryName:\s+(HelloWorld.local)\s+QueryStatus:\s+(\d+)\s+QueryResults:\s+(.*)\s+Image:\s+(c:\\windows\\system32\\ping\.exe)$”

  ---

An upvote would be appreciated and Accept solution if this reply helps!

View solution in original post

Tags (1)
0 Karma

vijaysri
Contributor

@venkatasri  its working ThanK you, do you have the doc from where you got the above config?

0 Karma

venkatasri
Motivator

@vijaysri  can't find splunk docs i referred add-on default/ dir for conf specs.

venkatasri
Motivator

@vijaysri Copy the same contents to /local dir inputs conf and enable it add index that's all you need to do assuming your outputs conf are working you will be able to search logs with specified  default source.

--

An upvote would be appreciated if this reply helps!

0 Karma