Splunking With Sysmon | Sysmon Integration with Splunk Enterprise ¦ Learn Splunk and Sysmon
This is a Short video about Sysmon Integration with Splunk .Splunk has been widely used all over the world for Log Collection and Correlation . In this video ,we have installed Splunk from Scratch and configured it to collect logs from Windows Event Logs including Sysmon Logs. This is 2nd and Last Part of our Earlier Video "How to Install And Set Up Sysmon" .
These Links were used in making both videos .
Download Sysmon and Sample Configuration
==================================
1. https://docs.microsoft.com/en-us/sysi...
2. https://github.com/olafhartong/sysmon... OR
3. https://github.com/SwiftOnSecurity/sy...
Installation of Sysmon with Configuration
==================================
sysmon -accepteula -i sysmonconfig.xml
Generate Logs via Atomic red team
=============================
https://redcanary.com/getting-started...
Download Splunk
================
https://www.splunk.com/en_us/download...
Speaker's Profile
===============
This Session is done by Shahzad Subhani .He is an information security enthusiast with 20 years of experience in different cyber security domains. His core expertise includes Malware Protection, Ant phishing, Email Security, Data Loss Protection, Encryption, Incident management, Digital forensics and SIEM Solutions. He is a hands-on guy and is always keen to mentor and share knowledge with his colleagues and juniors. He also writes Security articles as well as create videos on different information security topics.
Shahzad Subhani is also founder of GISPP (Global Information Security Society for Professionals of Pakistan) which has now members from 18 different countries. GISPP platform has brought many Pakistani Information security professionals together in order to share knowledge as well as to support each other professionally.
You can read More articles from Shahzad Subhani at this link .
https://www.gispp.org/user/shahzad-su...
About GISPP
===========
It is an effort by GISPP (Global Information Security Society for Professionals of Pakistan) .GISPP was initiated in 2016 by a group of Pakistani Information Security professionals living and working in Saudi Arabia. You can follow us on our social media links mentioned on our Channel Page .
#Sysmon #Splunk #Threathunting #GISPP #GisppAcademy #GisppTraining #Cybersecurity #Informationsecurity