Getting Data In

Does Windows Protected Event Logging work with Splunk?

MonkeyK
Builder

My company wants to set up Windows 10 Protected Event Logging for sensitive fields (currently this is only done for Powershell, but Microsoft may choose to use it for other logs as well). Protected Event logging would encrypt protected log events with a public key and then the accessing application would decrypt with a private key.

Does anyone know if Splunk can handle Protected Event logs and allow for their decryption as needed?

And what it would take to set Splunk up for Protected Event Logging? Things like
- how do I add the private key
- note the protected fields to decrypt
- specify which users get the field decrypted

1 Solution

brreeves_splunk
Splunk Employee
Splunk Employee

We are investigating making the necessary changes for a future release of the Splunk_TA_Windows. I have added the details of your request and the pertinent Technet Articles to the TA Development tracking. Currently there is no ETA for this feature.

View solution in original post

0 Karma

brreeves_splunk
Splunk Employee
Splunk Employee

We are investigating making the necessary changes for a future release of the Splunk_TA_Windows. I have added the details of your request and the pertinent Technet Articles to the TA Development tracking. Currently there is no ETA for this feature.

0 Karma

MonkeyK
Builder

Thank you for this response.
To help understand the motivation, we would like to be logging command lines and powershell, but it is hard to justify enabling that logging if user credentials are likely to be persisted into the logs. The potential of persisting user credentials in the logs poses a vulnerability in and of itself beyond what we might monitor powershell for.
I would highly recommend that anyone considering logging powershell consider this implication

We are hoping that by taking advantage of Protected Event Logging, we will be able to mitigate the risk of user credentials being stored in the event logs.
The following two MS Blogs address the issues that I am discussing
https://blogs.technet.microsoft.com/srd/2015/06/10/advances-in-scripting-security-and-protection-in-...
https://blogs.msdn.microsoft.com/powershell/2015/06/09/powershell-the-blue-team/

0 Karma

mbrownoutside
Path Finder

How is this looking, gentlemen?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...