Windows & linux machines Integration

[fedayn05]

Hello Team,

I hope you are doing well , I have just integrated linux and windows logs via Splunk Forwarder.

The question i have is does the logs must come with a specific source type in order to be read by Entreprise security or not.  Because i have gone through this with firewall integration , i have set the wrong source type and i got the logs on splunk but it were not read at all by splunk entreprise.

Thank you for your time.

Kind regards,

[PickleRick]

There's more to that than this.

Sourcetype is the main way of telling Splunk what the particular "kind" of event is and what to do with it (including how to parse it into fields).

Additionally ES usually expects most of relevant data to fit the CIM data models (have proper fields defined, sometimes have predefined values in those fields).

So technically you could change the sourcetypes for everything you're ingesting. But in order to be able to effectively use this data with ES you'd need to define all those things that are typically done by add-on creators - parsing, normalizing, tagging.

It's definitely _not_ worth the effort if you already have a working add-on which does that for you.

[fedayn05]

Hello,

Thank you for your answer. Do you have in mind an add-on for this please

Thank you

[PickleRick]

For Windows data you have the TA_windows from Splunk. For some linux stuff you have the TA_nix. I think there was a separate addon for auditd. So there's no single add-on which will cover all your needs. You have to search on a per-case basis.

[livehybrid]

Hi @fedayn05 

Are you using the Splunkbase Add-ons from Splunkbase to onboard the Linux and Windows logs? If so the default sourcetype that this comes with should be sufficient for Enterprise Security - It you stray away from the default sourcetypes then you run the risk of missing field extractions etc that map the data to the Common Information Models used by Splunk ES.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[fedayn05]

Hello,

Thank you for your answer. I actually installed the Splunk add-on for microsoft windows , and windows logs are stored with the WinEventLog sourcetype, so i dont know it this is good enough for Entreprise Security.

For linux , I actually did not install any add-on.

Thank uu