splunk
Splunk Add-on for Sysmon
Splunk Cloud
Splunk Built
Overview
Details
The Splunk Add-On for Sysmon enables customers to create and persist connection to Microsoft Sysmon so that the available detection, events, incident and audit data can be continually streamed to their Splunk Environment. This connection enables organisations to combine the power of the Splunk platform with the visibility and rich event data source of the Microsoft Sysmon utility running on Windows platforms. The Splunk Add-on for Sysmon collects data from Sysmon’s dedicated Windows Event log. Add-On map events for CIM data models: Endpoint, Network Resolution (DNS), Network Traffic, Change.
The Splunk Add-on for Sysmon provides the inputs and CIM-compatible knowledge to use with other Splunk apps, such as Splunk Enterprise Security and the Splunk App for PCI Compliance.
The Splunk Add-on for Sysmon provides the inputs and CIM-compatible knowledge to use with other Splunk apps, such as Splunk Enterprise Security and the Splunk App for PCI Compliance.
Documentation for this add-on is posted at Splunk Docs
Release Notes
Version 4.0.0
Nov. 17, 2023
Add support for Sysmon 15.0
New EventID 29 introduced
Other fixes and modifications (fixed DestinationHostname and Rule fields extraction, fixed action for EventID 12, added non DM field for file path)
Breaking change:
Mapping changed for EventIDs 4, 7, 16, 27, 28