Universal Forwarder and AppLocker Events XML

[pirsa]

Hey Guys trying to toubleshoot an issue here. Trying to get the XML events from the UF on Windows machines into splunk.

The normal

[WinEventLog://Microsoft-Windows-AppLocker/EXE and DLL]

seems to work, but for some reason if I change to get the extended xml version of

[XmlWinEventLog://Microsoft-Windows-AppLocker/EXE and DLL]

it does not send anything through to the indexer.

I am wondering if there is maybe a setting in windows preventing the splunk UF from obtaining the XML exports of the events? anyone able to shed some light on this?

[jeremyhagand61]

Add renderXml=true to your stanza

[Flo-Paris]

Hello,

Did you find a solution ? i have the same issue, i dont know how to get in my splunk the xml part of the eventlog where the most useful information (file signature, full file path, etc...) are concerning AppLocker...

Any help ?

thanks,

Florent