Windows Logs in Endpoint data model

[sinhashubham014]

Hello, i am deploying the ESCU searches in our environment. However, the endpoint logs are not ingested in Splunk. However for deploying the usecases, I ingested the Windws Security Logs with win event 4688/4689 to monitor the usecases. Sysmon logs are not ingested well. The Windows logs, configured with endpoint model are triggering the notables. Is it triggered notables relevant with the incident triage?

[gcusello]

Hi @sinhashubham014,

I suppose that you are using the Splunk_TA_Windows on the Search Head for parsing.

Anyway, log ingestion isn't managed by ESCU: ESCU contains many Correlation Searches to use in ES or simply in Splunk Enterprise, no parsing or ingesting rules.

See if you are correctly parsing your logs and if there are the eventtypes to assign the correct tagging to your logs, so the DataModels are correctly populated.

Ciao.

Giuseppe

[sinhashubham014]

I have configured the Endpoint data model logs with windows:security, system and registery logs. However, when i triggered the ESCU usecases, it's showing the events.

[gcusello]

HI @sinhashubham014 ,

which ESCU Use Cases are triggered?

Why isn't the result you want?

Ciao.

Giuseppe