Anexo A - inputs.conf

Ruta final en este PC: C:\Program Files\SplunkUniversalForwarder\etc\apps\SOC-Windows-Local\local\inputs.conf Rol: define qué datos recoge el Splunk Universal Forwarder.

## ===========================================================
## inputs.conf - Splunk Universal Forwarder (PC local analista SOC)
## Ruta destino: $SPLUNK_HOME\etc\apps\SOC-Windows-Local\local\inputs.conf
## ===========================================================
 
[default]
host = poisonxploit
 
## --- Windows Event Logs criticos para SOC -------------------------------
[WinEventLog://Security]
disabled = 0
index = win_security
renderXml = true
checkpointInterval = 5
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
 
[WinEventLog://System]
disabled = 0
index = win_system
renderXml = true
 
[WinEventLog://Application]
disabled = 0
index = win_app
renderXml = true
 
[WinEventLog://Setup]
disabled = 0
index = win_setup
renderXml = true
 
[WinEventLog://Microsoft-Windows-Sysmon/Operational]
disabled =0
index = win_sysmon
renderXml = true
checkpointInterval = 5
 
[WinEventLog://Microsoft-Windows-PowerShell/Operational]
disabled = 0
index = win_powershell
renderXml = true
 
[WinEventLog://Microsoft-Windows-Windows Defender/Operational]
disabled = 0
index = win_defender
renderXml = true
 
[WinEventLog://Microsoft-Windows-WMI-Activity/Operational]
disabled = 0
index = win_wmi
renderXml = true
 
[WinEventLog://Microsoft-Windows-TerminalServices-LocalSessionManager/Operational]
disabled = 0
index = win_rdp
renderXml = true
 
[WinEventLog://Microsoft-Windows-TaskScheduler/Operational]
disabled = 0
index = win_tasks
renderXml = true
 
[WinEventLog://Microsoft-Windows-PrintService/Admin]
disabled = 0
index = win_print
renderXml = true
 
## --- Perfmon CPU/Memoria/Red (anomalias y baselines) -------------------
[perfmon://CPU]
interval = 60
counters = % Processor Time; % User Time; % Privileged Time; % Interrupt Time
instances = _Total
index = win_perfmon
disabled = 0
 
[perfmon://Memory]
interval = 60
counters = Available MBytes; Committed Bytes; % Committed Bytes In Use; Pool Paged Bytes; Pool Nonpaged Bytes
index = win_perfmon
disabled = 0
 
[perfmon://Network]
interval = 60
object = Network Interface
counters = Bytes Total/sec; Packets/sec; Packets Received Errors; Output Queue Length
instances = *
index = win_perfmon
disabled = 0
 
[perfmon://LogicalDisk]
interval = 60
counters = % Free Space; Avg. Disk sec/Transfer; Disk Read Bytes/sec; Disk Write Bytes/sec
instances = *
index = win_perfmon
disabled = 0
 
## --- Endpoint script: estado del UF ------------------------------------
[script://$SPLUNK_HOME\bin\scripts\win-listen.bat]
disabled = 0
interval = 300
index = win_status
sourcetype = script:win-listen
 
## --- File Integrity Monitoring (rutas criticas) -----------------------
[monitor://C:\Windows\System32\drivers\etc\hosts]
disabled = 0
index = win_fim
sourcetype =_hosts_file
 
[monitor://C:\Windows\System32\drivers\etc\lmhosts]
disabled = 0
index = win_fim
 
[monitor://C:\Windows\System32\GroupPolicy]
disabled = 0
index = win_fim
recursive = true

Notas

• Ajustar host = poisonxploit a otro hostname si reaplicas en otro PC.
• Para entornos grandes con muchos eventos, start_from = oldest puede llevar colas prolongadas; cambiar a start_from = newest para producir sólo nuevos eventos tras el arranque.
• Si falta el script win-listen.bat, eliminar esa stanza (no afecta al resto).

Volver a: 00 - MOC Monitorización PC Local