diff --git a/Vagrant/bootstrap.sh b/Vagrant/bootstrap.sh index 68ca795..1587558 100644 --- a/Vagrant/bootstrap.sh +++ b/Vagrant/bootstrap.sh @@ -50,7 +50,7 @@ else /opt/splunk/bin/splunk add index sysmon -auth 'admin:changeme' /opt/splunk/bin/splunk add index powershell -auth 'admin:changeme' /opt/splunk/bin/splunk install app /vagrant/resources/splunk_forwarder/splunk-add-on-for-microsoft-windows_483.tgz -auth 'admin:changeme' - /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_600.tgz -auth 'admin:changeme' + /opt/splunk/bin/splunk install app /vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_607.tgz -auth 'admin:changeme' # Add a Splunk TCP input on port 9997 echo -e "[splunktcp://9997]\nconnection_host = ip" > /opt/splunk/etc/apps/search/local/inputs.conf # Add props.conf and transforms.conf diff --git a/Vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_600.tgz b/Vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_600.tgz deleted file mode 100755 index e44e316..0000000 Binary files a/Vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_600.tgz and /dev/null differ diff --git a/Vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_607.tgz b/Vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_607.tgz new file mode 100644 index 0000000..9ac442f Binary files /dev/null and b/Vagrant/resources/splunk_server/add-on-for-microsoft-sysmon_607.tgz differ