Splunk Enterprise Security

Endpoint Correlation Searches.

Albert_Cyber
Explorer

We are in the process of deploying our endpoint logging strategy. Right now, we are using CrowdStrike as our EDR. As far as I can tell if we wanted to use the logs collected by the CrowdStrike agent and forward that into Splunk we have to pay for the FDR license, which at the moment due to budget constraints we cannot.

When I look at the correlation searches that utilize the Endpoint Data model most of those detections are based on data that originates from Endpoint Detection and Response (EDR) agents. Since in our case we cannot utilize that data coming from CrowdStrike, could we use Sysmon instead to collect the data that we need to implement those corrections searches?

This is one of the use cases that I was interested in implementing

https://research.splunk.com/endpoint/1a93b7ea-7af7-11eb-adb5-acde48001122/

Labels (1)
0 Karma

Laszlo_K13
New Member

Please check this addon:

https://docs.splunk.com/Documentation/AddOns/released/MSSysmon/About

Documentation says is CIM compatible:

"The Splunk Add-on for Sysmon allows a Splunk software administrator to create a Splunk software data input and CIM-compliant field extractions for Microsoft Sysmon."

If the addon feeds the Endpoint.Processes datamodel, then the use case you are interested in might work.

 

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...