Getting Data In

Sysmon TA vs Splunk TA windows

omershira
Explorer

Hey,

We do have Sysmom installed on our Windows servers and workstations

A quick description of what sysmon is from docs.microsoft.com (link)
"sysmon is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log."

 

Since Sysmon itself does not offer as a product log analysis, we thought that sending the logs into Splunk would be the right solution here 😊

* A disadvantage of this is the need to set up and maintain dozens of Splunk UF's on workstations....

What application do I should install, If we already have deployed Splunk TA Windows?

We have found App & addon for sysmon in splunkbase. However, the data Sysmon generates is most of the time windows event logs and perfmon events, so the events would come into indexes generated by the Splunk TA windows. We do not want the information being doubled and collected in both apps under different sourcetypes and indexes....

Have anyone done this before? What's are your reccomendations?

Regards,

Tankwell

Labels (2)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...