Getting Data In

How to configure Splunk to aggregate security access event logs?

presbia_Marc
New Member

I was hoping that I could get security events with the forwarder. I installed the forwarder but all I am getting are system metrics. How do I configure this to do what I need for auditing purposes?

0 Karma

presbia_Marc
New Member

Yes, I turned on Auditing and I can see records being generated in the Security Log regarding access to folders, etc. The only records I am seeing in the tool on my standalone PC are like performance records. I installed the Forwarding Agent on the server. Maybe I need to configure that differently?

0 Karma

adonio
Ultra Champion

the doc linked in the answer below is great.
however, what are your "auditing purposes"? if its windows (assumed since you mentioned system), is your OS configured to capture these events e.g. windows security and audit rules turned on correctly? if linux, maybe auditd needed etc...
in any case, please elaborate / be more specific so we can better assist you
hope it helps

0 Karma

woodcock
Esteemed Legend
0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...