Knowledge Management

Windows Logs in Endpoint data model

sinhashubham014
Engager

Hello, i am deploying the ESCU searches in our environment. However, the endpoint logs are not ingested in Splunk. However for deploying the usecases, I ingested the Windws Security Logs with win event 4688/4689 to monitor the usecases. Sysmon logs are not ingested well. The Windows logs, configured with endpoint model are triggering the notables. Is it triggered notables relevant with the incident triage?

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sinhashubham014,

I suppose that you are using the Splunk_TA_Windows on the Search Head for parsing.

Anyway, log ingestion isn't managed by ESCU: ESCU contains many Correlation Searches to use in ES or simply in Splunk Enterprise, no parsing or ingesting rules.

See if you are correctly parsing your logs and if there are the eventtypes to assign the correct tagging to your logs, so the DataModels are correctly populated.

Ciao.

Giuseppe

0 Karma

sinhashubham014
Engager

I have configured the Endpoint data model logs with windows:security, system and registery logs. However, when i triggered the ESCU usecases, it's showing the events.

0 Karma

gcusello
SplunkTrust
SplunkTrust

HI @sinhashubham014 ,

which ESCU Use Cases are triggered?

Why isn't the result you want?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Video | Welcome Back to Smartness, Pedro

Remember Splunk Community member, Pedro Borges? If you tuned into Episode 2 of our Smartness interview series, ...

Detector Best Practices: Static Thresholds

Introduction In observability monitoring, static thresholds are used to monitor fixed, known values within ...

Expert Tips from Splunk Education, Observability in Action, Plus More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...