Splunk Enterprise Security

How to filter logs in Windows Server to decrease the quota of data in Splunk Enterprise Security (ES)?

dillencehsu
Path Finder

I using Splunk ES and I need filter logs in Windows Server(probably 200 servers) to decrease the quota of data.
In Windows Event Log, how many EventCodes is enough for Splunk Enterprise Security (ES)?
Do you need a list with EventCode?

Thanks : )

0 Karma
1 Solution

adonio
Ultra Champion

hello there,

i think you are looking at it backwards.
try to ask yourself, "what data do i need to see?" or "what security related questions i have?"
find out which windows event codes answer those questions and collect them.
another way to approach it, considering you are using only pre-built correlation searches and do not care about developing your own set of rules, is to open the correlation searches, see what they are searching against (most of the time data models) see how the data models are created, leveraging tags, see which tags are assigned to each event code, and filter the event codes that does not have the relevant tags
in any case, there are also another ways to decrease the volume of windows events in order to save on license
i think there is even an app for that: https://splunkbase.splunk.com/app/3500/

hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

hello there,

i think you are looking at it backwards.
try to ask yourself, "what data do i need to see?" or "what security related questions i have?"
find out which windows event codes answer those questions and collect them.
another way to approach it, considering you are using only pre-built correlation searches and do not care about developing your own set of rules, is to open the correlation searches, see what they are searching against (most of the time data models) see how the data models are created, leveraging tags, see which tags are assigned to each event code, and filter the event codes that does not have the relevant tags
in any case, there are also another ways to decrease the volume of windows events in order to save on license
i think there is even an app for that: https://splunkbase.splunk.com/app/3500/

hope it helps

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...