Splunk Windows network information

[joe06031990]

Hi,

I have a Splunk instance on Linux and I am trying to get windows network information from a IIS web server for example Port number,Protocol and IP address. I can get it to work on a windows instance just not from Linux not sure if it uses WMI just wondered if it was possible or would it need to be a powershell script?

Thanks

Joe

[gcusello]

Hi @joe06031990,

you have to:

• install a Splunk Universal Forwarder on one or all the Windows targets;
• on these UFs install e.g. the Splunk_Windows_TA (https://splunkbase.splunk.com/app/742/) that contains all the windows inputs: wineventlog, ps scripts, files, etc...;
• then, you can add more inputs (in the same TA or in a different one) to take the IIS logs and all the things you need, also other PS scripts.

Ciao.

Giuseppe

[joe06031990]

Hi, I have done the bellow and can get all apart from the network logs for ports,up addresses, ETC the only network details I see are bytes in/out.

thanks

Joe

[gcusello]

Hi @joe06031990,

Are you using Splunk TAs or custom inputs?

Did you tried the Splunk Add-On for Microsoft IIS (https://splunkbase.splunk.com/app/3185/#/overview)?

Ciao.

Giuseppe

[joe06031990]

Hi,

I have Splunk TA,IIS and Windows infrastructure app installed.

thanks

joe

[gcusello]

Hi @joe06031990,

if the information that you can have from those TAs aren't sufficient for your needs, the only way is to write your own scripts to insert in a custom TA.

Ciao.

Giuseppe

[joe06031990 · Accepted solution]

I've added:

[WinNetMon://test]
addressFamily = ipv4;ipv6
direction = inbound;outbound
host = WIN-PIDFR5LUJC6
packetType = connect;accept
protocol = tcp;udp

works fine now, Thanks for your help.

[gcusello]

Hi @joe06031990,

good for you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉