About Srini1207

Srini1207 · ‎02-23-2023

Hi Team, I am a newbie to the Splunk. I have install the Splunk Enterprise in a server and I have installed some of the forrwarders in other machines and I'm taking up the application, security, system and setup logs. But now, I want to monitor the websites he visited and the outlook application either it is separate application or running in browser. I want to monitor them in order to detect the phishing attacks. There is no web proxy servers and IIS servers. Can anyone suggest some ideas to complete this use case (On detecting the phishing attacks)

Srini1207 · ‎02-14-2023

Thanks for your reply @gcusello . Which account can be used as local system account? Also, I would like to know on how to collect the powershell logs, browser logs (chrome, edge and firefox) and all the applications that are running in it and files changes logs using the universal forwarder that are installed on all machines using local system account. I got some answer for powershell like this - #Monitor PowerShell Windows Event Logs [WinEventLog://Microsoft-Windows-PowerShell/Operational] disabled = 0 renderXml = 1 index = yourindex sourcetype = WinEventLog:Powershell What about others? Thanks, Srini

Srini1207 · ‎02-14-2023

Thanks for your reply @gcusello and your guess is right, we are trying to install it in the Windows But I trying to figure it which type of account we need to use under which circumstances. For example, Using Local system will get logs from local machine only. But if we use Domain account, we can remote machine logs where the forwarders are not installed (my understanding) and Virtual account, I had no idea on it. Can you explain this? Thanks Srini

Srini1207 · ‎02-14-2023

Hi Team, I'm a newbie to Splunk. I tried to install the Splunk Enterprise in my server and then it asked for the account type - Local, Domain and Virtual. I couldn't understand when to use which type of account. Can anyone clearly explain what the account types are, when it is used and under which conditions? Thanks

Srini1207 · ‎02-06-2023

Thanks for your reply, but can I able to collect the logs like PowerShell execution, internet explorer, chrome, and file monitoring activities? I think we can't be able to do it and that's why we are using WMI. If we can be able to collect those logs, what are the steps involved in it? If not, in which/what situation do we need to use UF and WMI? Thanks

Srini1207 · ‎02-01-2023

Hi everyone, I'm a newbie to Splunk. I installed Splunk Enterprise in a Server which is connected to AD. Other machine, I have installed the Universal Forwarder. I have a admin account for AD and with that I have installed the forwarder in other machine. I want to monitor all other logs from that machine. If try to collect the logs, it says that "Unable to get wmi classes from host 'xxxxx'. This host may not be reachable or WMI may be misconfigured". I have followed the steps under Configure Active Directory for running Splunk software as a domain user in this page - Prepare your Windows network to run Splunk Enterprise as a network or domain user page. Is that something am I missing?, Also, I'm not sure on how to collect the remote logs.

Srini1207 · ‎01-30-2023

I couldn't able to get it properly. While installing the Universal Forwarder, it will ask for what type of logs needs to be monitored (System, Security, Applications, Metrics, etc.). In that, what exactly it monitors? for example, in security we can track the logins and in metrics the CPU Performance and loads. I'm asking in that way.

Srini1207 · ‎01-25-2023

I have an idea of what logs can be collected by Universal Forwarder (Example - Application, Security, System, Forwarded event logs, Performance monitoring). But I want to know what exactly it collects in all those categories.

Posts	8
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎01-25-2023

Online Status	Offline
Date Last Visited	‎02-23-2023 12:01 PM

Can anyone suggest ideas for Monitoring Phishing a...

Types of Accounts - While Installing Splunk Enterp...

Why during Remote Log Collection, am I getting "Un...

What exact types of logs are collected by the Univ...

Can anyone suggest ideas for Monitoring Phishing a...

Re: Types of Accounts - While Installing Splunk En...

Re: Types of Accounts - While Installing Splunk En...

Types of Accounts - While Installing Splunk Enterp...

Re: Why during Remote Log Collection, am I getting...

Why during Remote Log Collection, am I getting "Un...

Re: Types of Logs collected by the Universal Forwa...

What exact types of logs are collected by the Univ...