All Apps and Add-ons

Lot of event codes are missing

julienlance
Explorer

Hello,

It seems that there's a lot of missing eventcodes in the EventCodes.csv lookup file, even in the last version of the app.
For instance, Event code between 4000 to 5000.
Why this file is not updated by Splunk and is there way to have to have an exhaustive file for our customers production environment ?

thanks for your help,

0 Karma

damann
Communicator

I just downloaded the newest Splunk App for Windows Infrastructure (Version 2.0.0) and counted 251 Eventcodes in the range [4000,5000]

I compared them with https://www.ultimatewindowssecurity.com which is a good starting point if you are looking for some infos regarding the Event Codes and found 255 Eventcodes in the range [4000,5000]

Which Eventcodes you are missing?

0 Karma

julienlance
Explorer

Hello Damann,

Thanks for your time.

For instance, in the last 24 hours :
4001,4013,4015,4016,4521

Others missing codes in another ranges :
134,404,407,408,2004,5774,5775,5781,6523,6527,6534,7050,7600,7681

Thanks !

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...