Merge pull request #434 from olafhartong/patch-1

Added missing subscription forward rule
2020-05-02 12:17:39 -07:00
parent 6de7ffa8d5 7476ff94df
commit c8514a49a4
1 changed files with 9 additions and 0 deletions
--- a/Vagrant/resources/splunk_forwarder/wef_inputs.conf
+++ b/Vagrant/resources/splunk_forwarder/wef_inputs.conf
@@ -411,6 +411,15 @@ start_from = oldest
 current_only = 0
 checkpointInterval = 5

+[WinEventLog://WEC2-Object-Manipulation]
+sourcetype = WinEventLog:Security
+source = WinEventLog:Object-Handle
+index=wineventlog
+disabled = 0
+start_from = oldest
+current_only = 0
+checkpointInterval = 5
+
 [monitor://c:\pslogs]
 index = powershell
 sourcetype = powershell_transcript