I used cyberark and created 3 servers via cyberark and installed splunk this server machine 192.0.0.1 via cyberark access remote desktop connection. Currently, this machine gets an event log. If someone accesses this machine, a login event is received in splunk
but it doesn't show that the login event occurred from where?
The windows event log has src ip, but does it mean where did the login event occur from?
If the client PC logs into the Windows server directly, that is the IP address of the client PC.
If the client PC logs into the Windows server through CyberArk, that is the CyberArk IP address.
I want the windows event log to send IP.
In the two cases above, I want to get the IP address of the Windows server.
Flowchart
