Monitoring Wireshark usage with splunk

[lclay95]

The goal i have is to track when a user launch wireshark i want to see what user launched it. I also want to see what the user is doing within the application such as packets that were captured etc. Is this possible to do within Splunk enterprise. Are there any additional apps i will need to make the activity easily readable?

[deepakc]

What you can do is to monitor process or service types of events from Windows or Linux systems and monitor if it’s being run. You can't check what the packets directly into Splunk from the Wireshark app, unless the user left behind pcap files, which can be collected and read by Splunk Stream app.  

You will need to first look at your systems and run Wireshark and analyse the processes or services that are running and then and look at the various TA's to help ingest the data and monitor using the various fields that contain the data.

To Monitor Process and Services you need to look at the Windows Sysmon Or Windows TA and the Splunk Nix TA for Linux based systems. (These will also show users logged on, what commands run etc and use SPL to analyse)

Look at the  below and explore the various options available to you.

#Sysmonlog

https://splunkbase.splunk.com/app/5709 

#Windows TA

https://splunkbase.splunk.com/app/742 

#Nix TA

https://splunkbase.splunk.com/app/3412 

#Stream App + Pcap

https://docs.splunk.com/Documentation/StreamApp/8.1.1/DeployStreamApp/UseStreamtoparsePCAPfiles