Splunk Enterprise Security

Can WinEventLog populate the Endpoint datamodels?

danielbb
Motivator

We wonder whether the WinEventLog can be applied to the Endpoint datamodels.

It seems to us that -

Endpoint.Process fits greatly win event id 4688 (A new process has been created).
Endpoint.Service could be populated with win event ID 4697 (A new service was installed)

However Source types for the Splunk Add-on for Windows lists for the CIM data models -
Application State, Authentication, Change Analysis, Performance, Updates and Vulnerabilities, while Application State is listed as deprecated.

0 Karma

spayneort
Contributor

Yes, and you can use this to help:

https://github.com/aholzel/SA-ESS-Windows

Splunk App for Enterprise Security and Windows Security log

Purpose of the app is:

Fix things the default Splunk Windows apps break
Fill the Enterprise Security Datamodels

.

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...