Knowledge Management

Windows Logs in Endpoint data model

sinhashubham014
Engager

Hello, i am deploying the ESCU searches in our environment. However, the endpoint logs are not ingested in Splunk. However for deploying the usecases, I ingested the Windws Security Logs with win event 4688/4689 to monitor the usecases. Sysmon logs are not ingested well. The Windows logs, configured with endpoint model are triggering the notables. Is it triggered notables relevant with the incident triage?

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sinhashubham014,

I suppose that you are using the Splunk_TA_Windows on the Search Head for parsing.

Anyway, log ingestion isn't managed by ESCU: ESCU contains many Correlation Searches to use in ES or simply in Splunk Enterprise, no parsing or ingesting rules.

See if you are correctly parsing your logs and if there are the eventtypes to assign the correct tagging to your logs, so the DataModels are correctly populated.

Ciao.

Giuseppe

0 Karma

sinhashubham014
Engager

I have configured the Endpoint data model logs with windows:security, system and registery logs. However, when i triggered the ESCU usecases, it's showing the events.

0 Karma

gcusello
SplunkTrust
SplunkTrust

HI @sinhashubham014 ,

which ESCU Use Cases are triggered?

Why isn't the result you want?

Ciao.

Giuseppe

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...