Getting Data In

Sysmon TA vs Splunk TA windows

omershira
Explorer

Hey,

We do have Sysmom installed on our Windows servers and workstations

A quick description of what sysmon is from docs.microsoft.com (link)
"sysmon is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log."

 

Since Sysmon itself does not offer as a product log analysis, we thought that sending the logs into Splunk would be the right solution here 😊

* A disadvantage of this is the need to set up and maintain dozens of Splunk UF's on workstations....

What application do I should install, If we already have deployed Splunk TA Windows?

We have found App & addon for sysmon in splunkbase. However, the data Sysmon generates is most of the time windows event logs and perfmon events, so the events would come into indexes generated by the Splunk TA windows. We do not want the information being doubled and collected in both apps under different sourcetypes and indexes....

Have anyone done this before? What's are your reccomendations?

Regards,

Tankwell

Labels (2)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...