We have to use Graylog to forward Windows events to our SPLUNK. However we are trying to use CIM model and we have asked the graylog folks to alias some fields. I have been looking at the props.conf from the slunk_ta_windows app and asking our graylog folks to alias the fields to match those in the TA_windows app, which as long as I set the source and source type to wineventlog:security they appear to be working. But I am trying to understand these commands and what they do?
LOOKUP-action_for_windows0_security = windows_audit_changes_lookup EventCode OUTPUTNEW action,change_type,object_category
REPORT-privilege_id_for_windows_security = privilege_id_for_windows_security
Once I can understand these I can probably get closer to all the fields I need graylog to send.
Thanks!
