Technology Add-on for Microsoft Windows
Overview
Details
Don't forget to rate the add-on and to provide feedback!
Author: my2ndhead
Source type(s):
- wineventlog:security
- wineventlog:application
- wineventlog:system
- xmlwineventlog:security
- xmlwineventlog:application
- xmlwineventlog:system
- Perfmon:CPU
- Perfmon:CPUTime
- Perfmon:System
- Perfmon:FreeDiskSpace
- Perfmon:LogicalDisk,
- Perfmon:LocalNetwork
- Perfmon:Process
- Perfmon:Memory
- Perfmon:Network
- WinHostMon
- DhcpSrvLog
- WinRegistry
- Script:InstalledApps
- Script:ListeningPorts
- Script:TimesyncConfiguration
- Script:TimesyncStatus
Supported product(s):
- Windows 2008 R2 and 7
- Windows 2012 R2 and 8.1
- Windows 2016 and 10
App Version: 1.0
Supported CIM Version: >=4.4.0
Supported CIM Data Models:
- Application State
- Authentication
- Change Analysis
- Inventory
- Performance
- Update
Eventgen Samples included: Yes
Add-on contains: Search and Parsing-Time configuration
===
Add-on is a partial replacement for Splunk_TA_windows. Focus is on CIM compliancy and performance.
Note 1: Test this add-on first on a separate Search Head before running in production.
Note 2: App is not compatible with Splunk App for Windows Infrastructure due to different eventtype naming
Note 3: App does not include following bin scripts, due to copyright reasons. Run Splunk_TA_windows on Forwarders instead.
- bin/win_installed_apps.bat
- bin/win_listening_ports.bat
- bin/win_timesync_status.bat
- bin/win_timesync_configuration.bat
Note 4: You can collaborate on the TA at https://github.com/my2ndhead/TA-microsoft-windows
Microsoft KB Documents used for lookups:
- Description of security events in Windows 7 and in Windows Server 2008 R2: https://support.microsoft.com/en-us/kb/977519
- Where can I find the full list of Failure Reasons for event 4625? o
http://answers.microsoft.com/en-us/windows/forum/windows_vista-security/where-can-i-find-the-full-list-of-failure-reasons/d0269426-2183-4d99-8af0-cc009dee6658 - LogLevel Enumeration: https://msdn.microsoft.com/en-us/library/microsoft.windowsazure.diagnostics.loglevel.aspx
Todo: Improve CIM Datamodel compatibility (ongoing)
License: Creative Commons Attribution 4.0 International
https://creativecommons.org/licenses/by/4.0/
Release Notes
Version 1.0
First Release, see README.txt