Installation

Change auditor collect

ALLIACOM
New Member

hello every body ,

someone know how to configure splunk for collect change auditor logs please ?

Thansk in advance

Tags (1)
0 Karma

Richfez
SplunkTrust
SplunkTrust

I'd check your documentation - apparently there's a SIEM Integration Guide with a section on Integration with Splunk.

I'd need a login at the change auditor site in order to see the details (which you should have if you own the software), but the little that I see when I search their KBase tells me mostly what we need to know.

When searched for siem, https://support.quest.com/change-auditor/kb?k=siem, shows a couple of tidbits:

... to write Change Auditor audited events locally to a Windows event log.

And also

Select the subsystems to include in the subscription. Click Finish. For more information please see the "Managing a Splunk integration" section of the SIEM Integration Guide.

When you put those two together, I believe Change Auditor can record events into the Windows Event Log, and from there you can either collect them into Splunk via UF or WMI, or can use Event Log Forwarding (an MS thing) to move those logs to another system, from where you can collect them via UF or WMI.

But either way, that SIEM guide should get you started!

Happy Splunking!
-Rich

0 Karma

manish_singh_77
Builder

Hi Alliacom,

Pls refer the below link for more information, let me know if it works for you.

http://docs.splunk.com/Documentation/Splunk/6.1.4/Security/AuditSplunkactivity

0 Karma

ALLIACOM
New Member

Hi manish thank's for you answer but
i'm talking about dell change auditor logs and not splunk audit logs

0 Karma

manish_singh_77
Builder

Oh I see....

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!