Getting Data In

Which from available Windows event logs is used to track my browsing history?

skender27
Contributor

Hi,

I was wondering which is the log (data inputs -> event log collection -> localhost) to add at Splunk in order to analyze/track my browsing history (let's say from Firefox)?
I saw there is a log called Microsoft-Windows-HttpService/trace. Is that the correct one?

Thanks a lot,
Skender

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

http://blogs.msdn.com/b/wndp/archive/2007/01/18/event-tracing-in-http-sys-part-1-capturing-a-trace.a...

There is no Windows Event log that traces internet usage in this manner. You would need a logging proxy server or 3rd party software installed on the workstation / end point.

0 Karma

skender27
Contributor

I found this useful link:
https://splunkbase.splunk.com/app/1217/

Did you mean this as 3-rd party app?

Skender

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Reading the docs on that, it uses 3rd party software and SQLite to extract the browser history from IE, and then ingest that into Splunk.

A typical method for doing this would be to install a SQUID based proxy server on the network, and capture the log files off that squid proxy server, which will track all user's web based activity, along with server responses etc.

0 Karma

skender27
Contributor

I need this tracking only a s a proof for my local machine (with Splunk Enterprise installed).
So, what is the Internet Explorer available log in the event log collections?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...