Security

Is it better to enrich the data from UF Windows Log Data with Scripts?

elaborateGecko
Explorer

Hello all, 

Thank you for taking the time to consider my question, I'm mainly seeking to find if it's possible to better enrich the data that is obtained from Windows hosts running Splunk UF v8.2.5, namely [WinEventLog:Security] and [WinNetMon] capabilities. 

Currently we monitor for all new process run, as well as collect logs for unfamiliar IPv4 addresses reached out to by creating a inputs.conf blacklist for internal IPv4s and common websites. I'm curious if we can further enrich this data by using powershell scripts to lookup these IPv4s according to that hosts DNS resolution, (not retroactively resolving them at the point of analysis, which can lead to different results if the endpoint's DNS cache was compromised). 

Additionally, I'm wondering if it's possible to use something like a powershell script to retrieve the SHA256 file hash of new processes run with the parsed log. It could be that what I need to do is just run Sysmon and monitor that, and I'm very much for that, but I've heard from more veteran employees at the company I'm currently at that sysmon killed performance and isn't feasible on endpoints. I'm very much a rookie and wasn't in a position to argue otherwise, but as far as I know sysmon has a rather light footprint in comparison to it's robust capabilities. 

Any advice on these topics is greatly appreciated, and will be rewarded with karma!

Labels (1)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

About IPv4 blacklist

* Yeah for sure you can write a custom PowerShell script that reads the EventViewer and does filtration. But you have to take that into account how much time you would need to build that capability from scratch.

* That to say the option of using [WinEventLog:Security] and combining that with PowerShell script is not possible directly today.

* One other option you have is to filter the logs before it reaches the EventLog. (I'm not a Windows expert so don't know how to do it, but I'm sure there is a way you can write rules.)

 

About Sysmon

* I kinda agree that Sysmon is light weight comparitive to its capability.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...