Splunk Windows Configuration Example

2017-03-17 10:00:56 +01:00
parent d2a9a91175
commit dc00baacda
1 changed files with 31 additions and 0 deletions
@@ -0,0 +1,31 @@
+logsources:
+  windows-application:
+    product: windows
+    service: application
+    conditions:
+      sourcetype: 'WinEventLog:Application'
+  windows-security:
+    product: windows
+    service: security
+    conditions:
+      sourcetype: 'WinEventLog:Security'
+  windows-security:
+    product: windows
+    service: system
+    conditions:
+      sourcetype: 'WinEventLog:System'
+  windows-sysmon:
+    product: windows
+    service: sysmon
+    conditions:
+      source: 'WinEventLog:Microsoft-Windows-Sysmon/Operational'
+  windows-powershell:
+    product: windows
+    service: powershell
+    conditions:
+      source: 'WinEventLog:Microsoft-Windows-PowerShell/Operational'
+  windows-powershell:
+    product: windows
+    service: taskscheduler
+    conditions:
+      source: 'WinEventLog:Microsoft-Windows-TaskScheduler/Operational'