Skip to content

Instantly share code, notes, and snippets.

@f8al
Created October 30, 2018 14:19
Show Gist options
  • Save f8al/339ba3302eac6fe3983e4517747de04d to your computer and use it in GitHub Desktop.
Save f8al/339ba3302eac6fe3983e4517747de04d to your computer and use it in GitHub Desktop.
images to add to sysmon configs to avoid logging loops when using splunk
<!-- SECTION: Splunk-->
<!--COMMENT: without omitting the splunkd image from a universal forwarder or full installation, you will get a log loop from connection logging, logging everytime the forwarder sends logs to an indexer on 9997, and then logging the connection it made to send the log, over and over, its turtles all the way down.-->
<Image condition="is">C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</Image><!--Splunk Universal Forwarder-->
<Image condition="is">C:\Program Files\Splunk\bin\splunkd.exe</Image><!--Splunk daemon-->
<Image condition="is">C:\Program Files (x86)\SplunkUniversalForwarder\bin\splunkd.exe</Image><!--Splunk Universal Forwarder-->
<Image condition="is">C:\Program Files (x86)\Splunk\bin\splunkd.exe</Image><!--Splunk daemon-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment