Hi,
I am runnig Splunk 9.0.9 with Splunk Add-on for Sysmon 4.0.1 and Sysmon Security Monitoring App for Splunk 4.0.13.
I configured the alerts to be sent by email and I am receiving many of them (false positives thanks god).
At this point I have two issues:
- The field "Body" is always empty.
Reviewing the macros included in the app, they seem to be created for the non-XML sysmon events. I changed the inputs.conf from the TA-Windows-Sysmon addon without success. The events continue flowing in in XML format.
[WinEventLog://Microsoft-Windows-Sysmon/Operational]
disabled = false
renderXml = 0
source = WinEventLog:Microsoft-Windows-Sysmon/Operational
Did anyone face the same issue? how did you solve it?
- I also would like to add an exception list of processes to reduce the amount of alerts, whitelisting some well known windows executables or tools. have anyone done that? could you tell me the approach you took?
thanks a lot.
I am checking other alternatives like Cyences https://splunkbase.splunk.com/app/5351. any opinion?
