Getting Data In

How do I get a Splunk universal forwarder to send explicit Event ID Events Only?

johann2017
Explorer

Hello,

I'm interested in installing universal forwarders (UF) on machines to ingest local security event logs into Splunk. However, I don't want every single security event log sent from the UFs to the heavy forwarder.

This leads to two questions:
1. Am I able to specify exactly which Event log IDs to send?
2. In addition to specifying Event Log IDs, can I get more granular and, for instance, send only Event ID 4732 logs (a member was added to a security-enabled group) but specify ONLY to send if it matches additional criteria — for members added to particular groups such as the local administrators group?

0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Hi @johann2017

Yes Its definitely possible to filter by IDs. I would recommend you have a quick read of this PDF from the experts at Aplura:
https://www.aplura.com/docs/SplunkWindowsEventLogs.pdf

It has some very good links to blacklists that you can use to filter the events and reduce your ingest.

All the best.

View solution in original post

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @johann2017

Yes Its definitely possible to filter by IDs. I would recommend you have a quick read of this PDF from the experts at Aplura:
https://www.aplura.com/docs/SplunkWindowsEventLogs.pdf

It has some very good links to blacklists that you can use to filter the events and reduce your ingest.

All the best.

0 Karma

johann2017
Explorer

Thanks I think that will get me kickstarted!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...