3 replies to this topic

[pokix]

Hello dear Netwrix users,

 

I am trying to forwarding Netwrix collected data toward a Splunk indexer.

 

According to Netwrix official documentation, you have to use Settings -> Data inputs -> Remote event log collections in Splunk

 

However, on Splunk version 6.4.3 and 6.5, this doesn't seem to exist anymore. Is there another way to perform it ?

 

Thanks in advance.

Regards

[jeffb]

Hello,

 

Currently there are two ways to collect Windows Events from a machine using Splunk in newer versions.  Splunk documentation will have everything you need because what you are basically doing is telling Splunk to collect certain Windows Event logs and it is not necessarily Netwrix specific instructions.

 

There are 2 ways to implement integration now:

 

1) Use a universal forwarder to get remote Windows data, it's a part  of Splunk.

2) Use WMI

 

Splunk docs http://docs.splunk.c...itorWindowsdata

 

-Jeff

[pokix]

Hello Jeff,

 

 

Thank you for your reply.

 

However I actually don't get a point. What I am trying to do is to forward the events formatted by Netwrix after an AD audit into a Splunk server.

Where can I find those formatted logs ? Are they part of the Windows Events logs ? Or does Netwrix store them elsewhere ?

 

Regards

[jeffb]

Pokix,

 

Netwrix doesn't forward any events.  We store the changes in a .EVTX format in the Windows Event Log.  Splunk then targets and consumes those Windows events.

 

-Jeff