Getting Data In
Highlighted

Is it recommended to install Universal Forwarder on all Workstations?

Builder

Hi

Is it the best way to install Universal Forwarders on all Workstations and enable windows security events , Right Now I have UF's on all DC's?

Tags (1)
0 Karma
Highlighted

Re: Is it recommended to install Universal Forwarder on all Workstations?

Communicator
0 Karma
Highlighted

Re: Is it recommended to install Universal Forwarder on all Workstations?

Ultra Champion

If your asking "is there value" in installing the UF on workstations the answer is almost certainly "yes"

But you should consider a few things first:

  • Monitoring your DCs will show you failed/successful domain logins, but they may not include all the security relevant events, such as all attempts using local credentials or local file/device access.
  • With the UF on your workstations you can also start to monitor application logs, or with SplunkStream even wireline traffic for remote diagnostics etc.
  • But - you can easily start collecting huge amounts of data, so be sure your indexer disk (or your index management) has been spec'd to cope - and most importantly consider the size of your licence!

View solution in original post