Getting Data In

How does a LOOKUP and Report command work in a PROPS.CONF ?

pfabrizi
Path Finder

We have to use Graylog to forward Windows events to our SPLUNK. However we are trying to use CIM model and we have asked the graylog folks to alias some fields. I have been looking at the props.conf from the slunk_ta_windows app and asking our graylog folks to alias the fields to match those in the TA_windows app, which as long as I set the source and source type to wineventlog:security they appear to be working. But I am trying to understand these commands and what they do?

LOOKUP-action_for_windows0_security = windows_audit_changes_lookup EventCode OUTPUTNEW action,change_type,object_category
REPORT-privilege_id_for_windows_security = privilege_id_for_windows_security

Once I can understand these I can probably get closer to all the fields I need graylog to send.

Thanks!

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...