From dc00baacda024f45679abfedd0669e01bee5a4f6 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@bsk-consulting.de>
Date: Fri, 17 Mar 2017 10:00:56 +0100
Subject: [PATCH] Splunk Windows Configuration Example

---
 tools/config/splunk-windows-all.yml | 31 +++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 tools/config/splunk-windows-all.yml

diff --git a/tools/config/splunk-windows-all.yml b/tools/config/splunk-windows-all.yml
new file mode 100644
index 000000000..56f19c123
--- /dev/null
+++ b/tools/config/splunk-windows-all.yml
@@ -0,0 +1,31 @@
+logsources:
+  windows-application:
+    product: windows
+    service: application
+    conditions:
+      sourcetype: 'WinEventLog:Application'
+  windows-security:
+    product: windows
+    service: security
+    conditions:
+      sourcetype: 'WinEventLog:Security'
+  windows-security:
+    product: windows
+    service: system
+    conditions:
+      sourcetype: 'WinEventLog:System'
+  windows-sysmon:
+    product: windows
+    service: sysmon
+    conditions:
+      source: 'WinEventLog:Microsoft-Windows-Sysmon/Operational'
+  windows-powershell:
+    product: windows
+    service: powershell
+    conditions:
+      source: 'WinEventLog:Microsoft-Windows-PowerShell/Operational'
+  windows-powershell:
+    product: windows
+    service: taskscheduler
+    conditions:
+      source: 'WinEventLog:Microsoft-Windows-TaskScheduler/Operational'