diff --git a/tools/config/splunk-windows-all.yml b/tools/config/splunk-windows-all.yml
new file mode 100644
index 000000000..56f19c123
--- /dev/null
+++ b/tools/config/splunk-windows-all.yml
@@ -0,0 +1,31 @@
+logsources:
+  windows-application:
+    product: windows
+    service: application
+    conditions:
+      sourcetype: 'WinEventLog:Application'
+  windows-security:
+    product: windows
+    service: security
+    conditions:
+      sourcetype: 'WinEventLog:Security'
+  windows-security:
+    product: windows
+    service: system
+    conditions:
+      sourcetype: 'WinEventLog:System'
+  windows-sysmon:
+    product: windows
+    service: sysmon
+    conditions:
+      source: 'WinEventLog:Microsoft-Windows-Sysmon/Operational'
+  windows-powershell:
+    product: windows
+    service: powershell
+    conditions:
+      source: 'WinEventLog:Microsoft-Windows-PowerShell/Operational'
+  windows-powershell:
+    product: windows
+    service: taskscheduler
+    conditions:
+      source: 'WinEventLog:Microsoft-Windows-TaskScheduler/Operational'