Does Windows Protected Event Logging work with Splunk?

[MonkeyK]

My company wants to set up Windows 10 Protected Event Logging for sensitive fields (currently this is only done for Powershell, but Microsoft may choose to use it for other logs as well). Protected Event logging would encrypt protected log events with a public key and then the accessing application would decrypt with a private key.

Does anyone know if Splunk can handle Protected Event logs and allow for their decryption as needed?

And what it would take to set Splunk up for Protected Event Logging? Things like
- how do I add the private key
- note the protected fields to decrypt
- specify which users get the field decrypted

[brreeves_splunk · Accepted solution]

We are investigating making the necessary changes for a future release of the Splunk_TA_Windows. I have added the details of your request and the pertinent Technet Articles to the TA Development tracking. Currently there is no ETA for this feature.

[MonkeyK]

Thank you for this response.
To help understand the motivation, we would like to be logging command lines and powershell, but it is hard to justify enabling that logging if user credentials are likely to be persisted into the logs. The potential of persisting user credentials in the logs poses a vulnerability in and of itself beyond what we might monitor powershell for.
I would highly recommend that anyone considering logging powershell consider this implication

We are hoping that by taking advantage of Protected Event Logging, we will be able to mitigate the risk of user credentials being stored in the event logs.
The following two MS Blogs address the issues that I am discussing
https://blogs.technet.microsoft.com/srd/2015/06/10/advances-in-scripting-security-and-protection-in-...
https://blogs.msdn.microsoft.com/powershell/2015/06/09/powershell-the-blue-team/

[mbrownoutside]

How is this looking, gentlemen?