Splunk Enterprise

Monitoring Wireshark usage with splunk

lclay95
Observer

The goal i have is to track when a user launch wireshark i want to see what user launched it. I also want to see what the user is doing within the application such as packets that were captured etc. Is this possible to do within Splunk enterprise. Are there any additional apps i will need to make the activity easily readable?

Labels (2)
0 Karma

deepakc
Builder

What you can do is to monitor process or service types of events from Windows or Linux systems and monitor if it’s being run. You can't check what the packets directly into Splunk from the Wireshark app, unless the user left behind pcap files, which can be collected and read by Splunk Stream app.  

You will need to first look at your systems and run Wireshark and analyse the processes or services that are running and then and look at the various TA's to help ingest the data and monitor using the various fields that contain the data.

To Monitor Process and Services you need to look at the Windows Sysmon Or Windows TA and the Splunk Nix TA for Linux based systems. (These will also show users logged on, what commands run etc and use SPL to analyse)

Look at the  below and explore the various options available to you.

#Sysmonlog

https://splunkbase.splunk.com/app/5709 

 

#Windows TA

https://splunkbase.splunk.com/app/742 

 

#Nix TA

https://splunkbase.splunk.com/app/3412 

 

#Stream App + Pcap

https://docs.splunk.com/Documentation/StreamApp/8.1.1/DeployStreamApp/UseStreamtoparsePCAPfiles

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...