Setting Up Splunk Universal Forwarder to Monitor and Analyze .evtx Files

[tuts]

Hello Splunk Community,

I have .evtx files from several devices, and I would like to analyze them using Splunk Universal Forwarder (the agent). I want to set up the agent to continuously monitor these files as if the data is live, so that I can apply Splunk Enterprise Security (ES) rules to them.

[tuts]

I have 1 TB of data that I want to analyze. Will TA_eventgenb be accepted?

[PickleRick]

No. It's not how not how it works. You wrote that you want to simulate a live system. That usually means continuous generation of events and reacting to them as they are ingested.

TA_eventgen does just that - it creates events based on configuration and templates.

[PickleRick]

1. While I think I've read somewhere some dirty tricks to import the events from evtx file, it's not something that's normally done. Usually you monitor the eventlog channels, not the evt(x) files themselves.

2. If you want to simulate a live system, it's usually not enough to ingest a batch of events from some earlier-gathered dump since the events will get indexed in the past. For such simulation stuff you usually use event generators like TA_eventgen.