Splunk_TA_windows_ms_inputs.conf

###### OS Logs ######

[WinEventLog://Application]
disabled = 0
index = win

[WinEventLog://Security]
disabled = 0
index = win

[WinEventLog://System]
disabled = 0
index = win

###### Windows Update Log ######
[monitor://$WINDIR\WindowsUpdate.log]
disabled = 0
index = win

[powershell://generate_windows_update_logs]
script = ."$SplunkHome\etc\apps\Splunk_TA_windows\bin\powershell\generate_windows_update_logs.ps1"
disabled = 0
index = winmon

[monitor://$SPLUNK_HOME\var\log\Splunk_TA_windows\WindowsUpdate.log]
disabled = 0
index = winmon

###### Scripted Input (See also wmi.conf)
[script://.\bin\win_listening_ports.bat]
disabled = 0
index = winmon

[script://.\bin\win_installed_apps.bat]
disabled = 0
index = winmon

[script://.\bin\win_timesync_status.bat]
disabled = 0
index = winmon

[script://.\bin\win_timesync_configuration.bat]
disabled = 0
index = winmon

[script://.\bin\netsh_address.bat]
disabled = 0
index = winmon

###### Network monitoring ######
[WinNetMon://inbound]
disabled = 0 
index = winmon
packetType = accept;connect
protocol = tcp;udp

[WinNetMon://outbound]
disabled = 0 
index = winmon
packetType = accept;connect
protocol = tcp;udp

[WinRegMon://hkcu_run]
disabled = 0
index = winmon

[WinRegMon://hklm_run]
disabled = 0
index = winmon