Splunk_TA_windows_dc_inputs.conf

###### OS Logs ######

[WinEventLog://Application]
disabled = 0
index = win

[WinEventLog://Security]
disabled = 0
index = win
blacklist1 = 
blacklist2 =

[WinEventLog://System]
disabled = 0
index = win

###### WinEventLog Inputs for Active Directory ######

[WinEventLog://DFS Replication]
disabled = 0
index = win

[WinEventLog://Directory Service]
disabled = 0
index = win

[WinEventLog://File Replication Service]
disabled = 0
index = win

[WinEventLog://Key Management Service]
disabled = 0
index = win

###### WinEventLog Inputs for DNS ######
[WinEventLog://DNS Server]
disabled = 0
index = win

###### Windows Update Log ######
[monitor://$WINDIR\WindowsUpdate.log]
disabled = 0
index = win

[powershell://generate_windows_update_logs]
script = ."$SplunkHome\etc\apps\Splunk_TA_windows\bin\powershell\generate_windows_update_logs.ps1"
disabled = 0
index = winmon

[monitor://$SPLUNK_HOME\var\log\Splunk_TA_windows\WindowsUpdate.log]
disabled = 0
index = winmon

###### Monitor Inputs for Active Directory ######
[monitor://$WINDIR\debug\netlogon.log]
disabled = 0
index = winmon

###### Scripted Input (See also wmi.conf)
[script://.\bin\win_listening_ports.bat]
disabled = 0
index = winmon

[script://.\bin\win_installed_apps.bat]
disabled = 0
index = winmon

[script://.\bin\win_timesync_status.bat]
disabled = 0
index = winmon

[script://.\bin\win_timesync_configuration.bat]
disabled = 0
index = winmon

[script://.\bin\netsh_address.bat]
disabled = 0
index = winmon

###### Scripted/Powershell Mod inputs Active Directory ######

[powershell://Replication-Stats]
disabled = 0
index = winmon
 
[powershell://AD-Health]
disabled = 0
index = winmon

[powershell://Siteinfo]
disabled = 0
index = winmon

###### Network monitoring ######
[WinNetMon://inbound]
disabled = 0
index = winmon
packetType = accept;connect
protocol = tcp;udp

[WinNetMon://outbound]
disabled = 0
index = winmon
packetType = accept;connect
protocol = tcp;udp

[admon://default]
disabled = 0
index = winmon 

[WinRegMon://hkcu_run]
disabled = 0
index = winmon

[WinRegMon://hklm_run]
disabled = 0
index = winmon