Getting Data In

How to configure Splunk to aggregate security access event logs?

presbia_Marc
New Member

I was hoping that I could get security events with the forwarder. I installed the forwarder but all I am getting are system metrics. How do I configure this to do what I need for auditing purposes?

0 Karma

presbia_Marc
New Member

Yes, I turned on Auditing and I can see records being generated in the Security Log regarding access to folders, etc. The only records I am seeing in the tool on my standalone PC are like performance records. I installed the Forwarding Agent on the server. Maybe I need to configure that differently?

0 Karma

adonio
Ultra Champion

the doc linked in the answer below is great.
however, what are your "auditing purposes"? if its windows (assumed since you mentioned system), is your OS configured to capture these events e.g. windows security and audit rules turned on correctly? if linux, maybe auditd needed etc...
in any case, please elaborate / be more specific so we can better assist you
hope it helps

0 Karma

woodcock
Esteemed Legend
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...