Netwrix TA

[Okezie1]

Has anyone ever installed the Netwrix addon in Splunk? Having a bit of trouble with how to do so. 

[acadea]

yes, I've configured the netwrix powerhsll script to be executed as a scheduled task . 
- also enabled the API on Netwrix ( see settings, API)
- configured splunk UFW to collect the windows event log netwrix_integration_bla_bla

what is the blocking point for you?

[Okezie1]

We were able to create a deployment app on our Heavy Forwarder, created a serverclass as well,  and customized the inputs.conf to grab the Winevent logs. However, the client stated that they were only receiving general audit information that showed who logged in, etc but didn't receive the actual log information.

https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/MonitorWindowseventlogdata#Monitor_Win...

This is the link we used to assist. 

[acadea]

who logged in... where ? on Netwrix ? on Windows/AD ?

there are 3 Netwrix generated eventlogs on Windows

[WinEventLog://Netwrix Auditor] - > this is the same EventLog that you can see in Netwrix interface regarding events related to data collection etc

[WinEventLog://Netwrix Auditor Security] - > this is containing Netwrix on Netwrix audit, that is who has started Netwrix, what changes were done in the Netwrix interface, etc. Netwrix Auditor Self-audit let's say. I suppose this is what you're describing as currently collected.

[WinEventLog://Netwrix_Auditor_Integration] - > this is what you're after. It should have this format:

08/24/2021 09:56:37 AM
LogName=Netwrix_Auditor_Integration
SourceName=Netwrix_Auditor_Integration_API
EventCode=35940
EventType=4
Type=Information
ComputerName=srv-01
TaskCategory=492
OpCode=Info
RecordNumber=41188878
Keywords=Classic
Message=
DataSource : Windows Server
Action : Modified
Message: Modified System Time
Where : srv-01
ObjectType : System Time
Who : NT AUTHORITY\SYSTEM
What : System Properties\System Time
When : 2021-08-24T07:36:22Z
Workstation :
Details : System time changed from "2021-08-24T07:36:08.173840600Z" to "2021-08-24T07:36:22.192000000Z"

[Okezie1]

I'll add the [WinEventLog://Netwrix Auditor]  and [WinEventLog://Netwrix_Auditor_Integration] stanzas as well and see what we're able to pull. 

[Okezie1]

My apologies, it was the Netwrix Auditor Security I was referring to. 

[acadea]

well, collect the other eventlog and maybe that will solve your problem ?

[acadea]

can you provide a link to that addon, I'm not able to find it on splunkbase.

or perhaps you're talking about the netwrix addon for splunk  which is a powershell script that is writing netwrix events to windows event log  so that splunk ufw can collect it ?

[Okezie1]

There is no Splunkbase TA. I'm referring to the Netwrix addon for Splunk which is a PowerShell script.