If i understand correctly, you want to monitor process creation.
For Windows servers, I'm familiar with two ways of process logging.
Option 1) Windows has a built-in feature for process tracking using the Windows Event Log. The particular Event Code we are interested in is 4688: A new process has been created.
By default, process tracking is turned off. You need to enable it in the Local Security Policy or via group policies:
Next, you need to configure Splunk to monitor the Windows Event Log. Something like this via inputs.conf:
[WinEventLog://Security]
disabled = false
index = windows
Now these events should be available in Splunk:
index=windows source="WinEventLog:Security" EventCode=4688
You can see that the user (Account Name), who ran this process, got logged. (I anonymized it.)
Option 2: You install Sysmon in conjunction with Add-on for Microsoft Sysmon.
Sysmon can log a wealth of information, including process creation. I find it particularly useful that Sysmon can log the hash value for each process/program. You will also see which user runs which process. However, Sysmon is slightly more complex to setup.
If i understand correctly, you want to monitor process creation.
For Windows servers, I'm familiar with two ways of process logging.
Option 1) Windows has a built-in feature for process tracking using the Windows Event Log. The particular Event Code we are interested in is 4688: A new process has been created.
By default, process tracking is turned off. You need to enable it in the Local Security Policy or via group policies:
Next, you need to configure Splunk to monitor the Windows Event Log. Something like this via inputs.conf:
[WinEventLog://Security]
disabled = false
index = windows
Now these events should be available in Splunk:
index=windows source="WinEventLog:Security" EventCode=4688
You can see that the user (Account Name), who ran this process, got logged. (I anonymized it.)
Option 2: You install Sysmon in conjunction with Add-on for Microsoft Sysmon.
Sysmon can log a wealth of information, including process creation. I find it particularly useful that Sysmon can log the hash value for each process/program. You will also see which user runs which process. However, Sysmon is slightly more complex to setup.
