Sysmon TA vs Splunk TA windows

[omershira]

Hey,

We do have Sysmom installed on our Windows servers and workstations

A quick description of what sysmon is from docs.microsoft.com (link)
"sysmon is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log."

Since Sysmon itself does not offer as a product log analysis, we thought that sending the logs into Splunk would be the right solution here 😊

* A disadvantage of this is the need to set up and maintain dozens of Splunk UF's on workstations....

What application do I should install, If we already have deployed Splunk TA Windows?

We have found App & addon for sysmon in splunkbase. However, the data Sysmon generates is most of the time windows event logs and perfmon events, so the events would come into indexes generated by the Splunk TA windows. We do not want the information being doubled and collected in both apps under different sourcetypes and indexes....

Have anyone done this before? What's are your reccomendations?

Regards,

Tankwell