splunk
Splunk Add-on for Sysmon
Splunk Cloud
Splunk Built
Overview
Details
The Splunk Add-On for Sysmon enables customers to create and persist connection to Microsoft Sysmon so that the available detection, events, incident and audit data can be continually streamed to their Splunk Environment. This connection enables organisations to combine the power of the Splunk platform with the visibility and rich event data source of the Microsoft Sysmon utility running on Windows platforms. The Splunk Add-on for Sysmon collects data from Sysmon’s dedicated Windows Event log. Add-On map events for CIM data models: Endpoint, Network Resolution (DNS), Network Traffic, Change.
The Splunk Add-on for Sysmon provides the inputs and CIM-compatible knowledge to use with other Splunk apps, such as Splunk Enterprise Security and the Splunk App for PCI Compliance.
The Splunk Add-on for Sysmon provides the inputs and CIM-compatible knowledge to use with other Splunk apps, such as Splunk Enterprise Security and the Splunk App for PCI Compliance.
Documentation for this add-on is posted at Splunk Docs
Release Notes
Version 5.0.0
July 30, 2025
granted_access_description field added for EventID 10
fixed:
- Hashes value assigned to file_hash instead of process_hash for EventIDs 24, 27 and 28
- registry_key_name and registry_value_name extractions for EventIDs 12, 13 and 14