Splunk Enterprise Security

Can WinEventLog populate the Endpoint datamodels?

danielbb
Motivator

We wonder whether the WinEventLog can be applied to the Endpoint datamodels.

It seems to us that -

Endpoint.Process fits greatly win event id 4688 (A new process has been created).
Endpoint.Service could be populated with win event ID 4697 (A new service was installed)

However Source types for the Splunk Add-on for Windows lists for the CIM data models -
Application State, Authentication, Change Analysis, Performance, Updates and Vulnerabilities, while Application State is listed as deprecated.

0 Karma

spayneort
Contributor

Yes, and you can use this to help:

https://github.com/aholzel/SA-ESS-Windows

Splunk App for Enterprise Security and Windows Security log

Purpose of the app is:

Fix things the default Splunk Windows apps break
Fill the Enterprise Security Datamodels

.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...