trinitor/DetectionLab
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Remove extraneous config stanza from WEF inputs

Browse Source
This commit is contained in:
Chris Long
2017-12-29 07:36:38 +07:00
committed by GitHub
parent fb7c8aa1af
commit 25174fc641
1 changed files with 0 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
Vagrant/resources/splunk_forwarder/wef_inputs.conf
View File

@@ -1,15 +1,3 @@
[default]
evt_resolve_ad_obj = 1
evt_dc_name = ldaps.ad.ha.palantir
evt_dns_name = ldaps.ad.ha.palantir
evt_ad_cache_disabled = 0
evt_ad_cache_max_entries = 40000
evt_ad_cache_exp_neg = 10
evt_sid_cache_disabled = 0
evt_sid_cache_max_entries = 40000
evt_sid_cache_exp_neg = 1000
batch_size = 500
[WinEventLog://ForwardedEvents] [WinEventLog://ForwardedEvents]
sourcetype = WinEventLog:ForwardedEvents sourcetype = WinEventLog:ForwardedEvents
index=wineventlog index=wineventlog