SYSMON and Splunk forwarder
Download
Config File
Install
Sysmon is just a service so running the exe will do nothing you need to run a Power-shell script
Navigate to the location of the above files easier if they are in the same folder
To check if the service is running
If running it should look like below if running, else it wont return anything if not running
Check if Event log channel exists
In Splunk Web UI
Make a index named win_sysmon
Splunk Universal Forwarder
Add this to the inputs.conf of your app
Restart the forwarder
In Splunk Web UI you should see data coming into the index
Troubleshooting
If you see errors like the ones below and are not receiving anything to the Splunk index
When you see errorCode=5 this is a permission issue and the Splunk forwarder cant read it. You need to give Splunk forwarder access to read the symon logs
Restart the Forwarder and check the index you created in the Splunk web UI
Last updated