The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.
For more information on this and other examples, download the free Splunk Security Essentials app on Splunkbase.
In this use case, we'll explore how to use Splunk Enterprise Security to uncover batch files (.bat) written to the Windows system directory tree.
Load data
This use case depends on file system monitoring data in the Filesystem dataset of the endpoint data model as defined by the Common Information Model (CIM). For simplicity, this example only uses file system audit events from Windows Security data but any data properly normalized for the Filesystem dataset works well. It’s a best practice to use the CIM to normalize data at search time, but before you put in effort to create new knowledge objects, check Splunkbase to see if such a CIM-compatible app or add-on already exists.
Best practice: In searches, replace the asterisk in index= with the name of the index that contains the data. By default, Splunk stores data in the main index. Therefore, index= becomes index=main. Use the OR operator to specify one or multiple indexes to search. For example, index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.
Best practice: Use the Splunk Add-on for Microsoft Windows to accelerate time to value the necessary Windows filesystem data. For details, see Is it a best practice to use the Splunk Add-on for Microsoft Windows? on Splunk Answers.
- Enable the
[WinEventLog://Security]input in the add-on to collect Windows security data. For details, see our post How do I collect basic Windows OS Event Log data from my Windows systems? on Splunk Answers. - Deploy the add-on to the search heads to use the Common Information Model to normalize the data at search time. See Install the Splunk Add-on for Windows in Splunk documents for the procedure.
- Enable Windows to generate file system monitoring. For instructions, see Monitor file system changes within the Splunk Enterprise Getting Data In Manual.
- Run the following search to verify you are collecting Windows data:
earliest=-1day index=* source=win*security tag=endpoint tag=filesystem | head 10
Best practice: Since Splunk normalizes values from multiple source types regardless of source or format, it’s a best practice to make sure your data is CIM-compliant. For more information about CIM and the Splunk Common Information Model (CIM) add-on see the Splunk Common Information Model Add-on Manual. Run the following search to verify you are searching for normalized Filesystem data and ready for this use case: earliest=-1day index=* tag=endpoint tag=filesystem | head 10
For more details about the Common Information Model, watch the following video.
Get insights
This scenario uses the Incident Review dashboard in Splunk Enterprise Security and underlying correlation searches. Use the following procedure to discover incidents:
- Navigate to the Splunk Enterprise Security web user interface.
- Select Incident Review from the top navigation bar.
- Select the text box under Correlation Search, begin typing Batch File Write to System32, select the use case from the drop-down list that appears.
- Select Submit to display notable events.
Review the Overview of Incident Review in Splunk Enterprise Security in Splunk docs for guidance on how to triage and act on resulting incidents. If no results appear, there may not be any notable notable events. However, you may need to enable correlation searches.
If no results appear, you may need to deploy the add-ons to the search heads to use the knowledge objects necessary for simple searching.
Watch the following video to see how the Use Case Library in Splunk Enterprise Security can strengthen your security posture and reduce risk with readily available, usable and relevant content.
The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.
For more information on this and other examples, download the free Splunk Security Essentials app on Splunkbase.
In this use case, we'll explore how to use Splunk Enterprise Security to uncover batch files (.bat) written to the Windows system directory tree.
Load data
This use case depends on file system monitoring data in the Filesystem dataset of the endpoint data model as defined by the Common Information Model (CIM). For simplicity, this example only uses file system audit events from Windows Security data but any data properly normalized for the Filesystem dataset works well. It’s a best practice to use the CIM to normalize data at search time, but before you put in effort to create new knowledge objects, check Splunkbase to see if such a CIM-compatible app or add-on already exists.
Best practice: In searches, replace the asterisk in index= with the name of the index that contains the data. By default, Splunk stores data in the main index. Therefore, index= becomes index=main. Use the OR operator to specify one or multiple indexes to search. For example, index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.
Best practice: Use the Splunk Add-on for Microsoft Windows to accelerate time to value the necessary Windows filesystem data. For details, see Is it a best practice to use the Splunk Add-on for Microsoft Windows? on Splunk Answers.
- Enable the
[WinEventLog://Security]input in the add-on to collect Windows security data. For details, see our post How do I collect basic Windows OS Event Log data from my Windows systems? on Splunk Answers. - Deploy the add-on to the search heads to use the Common Information Model to normalize the data at search time. See Install the Splunk Add-on for Windows in Splunk documents for the procedure.
- Enable Windows to generate file system monitoring. For instructions, see Monitor file system changes within the Splunk Enterprise Getting Data In Manual.
- Run the following search to verify you are collecting Windows data:
earliest=-1day index=* source=win*security tag=endpoint tag=filesystem | head 10
Best practice: Since Splunk normalizes values from multiple source types regardless of source or format, it’s a best practice to make sure your data is CIM-compliant. For more information about CIM and the Splunk Common Information Model (CIM) add-on see the Splunk Common Information Model Add-on Manual. Run the following search to verify you are searching for normalized Filesystem data and ready for this use case: earliest=-1day index=* tag=endpoint tag=filesystem | head 10
For more details about the Common Information Model, watch the following video.
Get insights
This scenario uses the Incident Review dashboard in Splunk Enterprise Security and underlying correlation searches. Use the following procedure to discover incidents:
- Navigate to the Splunk Enterprise Security web user interface.
- Select Incident Review from the top navigation bar.
- Select the text box under Correlation Search, begin typing Batch File Write to System32, select the use case from the drop-down list that appears.
- Select Submit to display notable events.
Review the Overview of Incident Review in Splunk Enterprise Security in Splunk docs for guidance on how to triage and act on resulting incidents. If no results appear, there may not be any notable notable events. However, you may need to enable correlation searches.
If no results appear, you may need to deploy the add-ons to the search heads to use the knowledge objects necessary for simple searching.
Watch the following video to see how the Use Case Library in Splunk Enterprise Security can strengthen your security posture and reduce risk with readily available, usable and relevant content.
