Splunk Enterprise Security

Can WinEventLog populate the Endpoint datamodels?


We wonder whether the WinEventLog can be applied to the Endpoint datamodels.

It seems to us that -

Endpoint.Process fits greatly win event id 4688 (A new process has been created).
Endpoint.Service could be populated with win event ID 4697 (A new service was installed)

However Source types for the Splunk Add-on for Windows lists for the CIM data models -
Application State, Authentication, Change Analysis, Performance, Updates and Vulnerabilities, while Application State is listed as deprecated.

0 Karma


Yes, and you can use this to help:


Splunk App for Enterprise Security and Windows Security log

Purpose of the app is:

Fix things the default Splunk Windows apps break
Fill the Enterprise Security Datamodels


Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...