Splunk-input-windows-baseline

An input.conf for the Splunk Universal Forwarder that collects more than 70 Windows event logs, maps them to MITRE ATT&CK, and filters out the noisy ones.

The project provides a single input.conf file that enables advanced Windows log collection through the Splunk Universal Forwarder. The differentiator, as the README puts it, is that it does not stick only to the Security event log and does not follow Microsoft's very generic logging policies. It was written by a threat detection analyst with detection, hunting, incident response, and forensics in mind.

The configuration takes an allow list approach, gathering only known and necessary event IDs and providers to limit license impact. Each event ID carries a description and, where applicable, a MITRE ATT&CK mapping. Coverage spans more than 70 native event logs, including Security, RDP, BitLocker, AppLocker, PowerShell, WinRM, Defender, NTLM, Firewall, OpenSSH, and SYSMON, and more than 10 server roles such as Active Directory, Exchange, SQL Server, IIS, and DHCP. The README also notes the collected events work with the author's SIGMA detection rules.

A list of exclusions explains the judgment calls. Firewall filtering platform events are dropped as very noisy, with SYSMON ID 3 suggested instead, and network share access events go the same way in favor of SYSMON IDs 17 and 18. Success NTLM logins are skipped, collecting only failures. Classic PowerShell events 600 and 800 are replaced by the modern 4103 and 4104. Out of scope items include Splunk metrics collection, noise reduction, and log file inputs like DNS debug logs. The sources that shaped the mapping are listed at the end, including an event log mindmap and the Palantir WEF and WEC guidance.

• Source 1 · Project repository
• Source 2 · README