##
## SPDX-FileCopyrightText: 2024 Splunk, Inc.
## SPDX-License-Identifier: LicenseRef-Splunk-8-2021
## DO NOT EDIT THIS FILE!
## Please make all changes to files in $SPLUNK_HOME/etc/apps/Splunk_TA_windows/local.
## To make changes, copy the section/stanza you want to change from $SPLUNK_HOME/etc/apps/Splunk_TA_windows/default
## into ../local and edit there.

###### Global Windows Eventtype ######

[eventtype=windows_event_signature]
track_event_signatures = enabled

[eventtype=wineventlog_windows]
os = enabled
windows = enabled

[eventtype=wineventlog_application]
os = enabled
windows = enabled

[eventtype=wineventlog_system]
os = enabled
windows = enabled

[eventtype=wineventlog_security]
os = enabled
windows = enabled

[eventtype=perfmon_windows]
os = enabled
windows = enabled

[eventtype=perfmon_processorinformation]
process = enabled
report = enabled
performance = enabled
cpu = enabled

[eventtype=hostmon_windows]
os = enabled
windows = enabled

[eventtype=hostmon_os]
os = enabled
windows = enabled
memory = enabled
performance = enabled
oshost = enabled

[eventtype=hostmon_inventory]
os = enabled
inventory = enabled
cpu = enabled
memory = enabled
oshost = enabled

[eventtype=hostmon_disk]
performance = enabled
inventory = enabled
storage = enabled
oshost = enabled

[eventtype=netmon_windows]
os = enabled
windows = enabled

[eventtype=printmon_windows]
os = enabled
windows = enabled

[eventtype=script_windows]
os = enabled
windows = enabled

[eventtype=wmi_windows]
os = enabled
windows = enabled

[eventtype=windowsupdatelog_windows]
os = enabled
windows = enabled

[eventtype=winregistry_windows]
os = enabled
windows = enabled
endpoint = enabled
change = enabled
registry = enabled

[eventtype=winsec]
security = enabled


###### DHCP ######
[eventtype=msdhcp]
dhcp    = enabled
network = enabled
session = enabled
windows = enabled

[eventtype=msdhcp_start]
start = enabled

[eventtype=msdhcp_end]
end = disabled

[eventtype=DhcpSrvLog]
windows = enabled

[eventtype=DhcpSrvLog_dhcp]
dhcp    = enabled
network = enabled
session = enabled

[eventtype=DhcpSrvLog_start]
dhcp    = enabled
network = enabled
session = enabled
start = enabled

[eventtype=DhcpSrvLog_end]
dhcp    = enabled
network = enabled
session = enabled
end = enabled


###### Security: Account Logon ######
[eventtype=windows_auth_ticket_granted]
authentication = enabled

[eventtype=windows_service_ticket_granted]
authentication = enabled

[eventtype=windows_pre_auth_failed]
authentication = enabled

[eventtype=windows_account_used4logon]
authentication = enabled

[eventtype=windows_session_disconnected]
access = enabled
stop = enabled
logoff = enabled


###### Security: Account Management ######
[eventtype=windows_account_management]
account = enabled
change = enabled
management = enabled

[eventtype=windows_account_created]
add = enabled
account = enabled
change = enabled

[eventtype=windows_account_enabled]
enable = enabled
account = enabled
change = enabled

[eventtype=windows_account_password_change]
password = enabled
modify = enabled
account = enabled
change = enabled

[eventtype=windows_account_password_set]
password = enabled
modify = enabled
account = enabled
change = enabled

[Service_Name=kadmin%2Fchangepw]
account = enabled
change = enabled
password = enabled
modify = enabled

[eventtype=windows_account_disabled]
disable = enabled
account = enabled
change = enabled

[eventtype=windows_account_deleted]
delete = enabled
account = enabled
change = enabled

[eventtype=windows_account_modified]
modify = enabled
account = enabled
change = enabled

[eventtype=windows_account_lockout]
lock = enabled
lockout = enabled
account = enabled
change = enabled

[eventtype=windows_account_unlocked]
modify = enabled
account = enabled
change = enabled

###### Security: Audit (Event Log) ######
[eventtype=windows_audit_log_stopped]
stop = enabled
stopped = enabled
watchlist = enabled

[eventtype=windows_audit_errors]
audit = enabled
error = enabled

[eventtype=windows_audit_log_cleared]
audit = enabled
change = enabled
delete = enabled
cleared = enabled
watchlist = enabled

[eventtype=windows_audit_backup]
audit = enabled
backup = enabled
change = enabled

[eventtype=windows_audit_log_logon]
audit = enabled
change = enabled

[privilege_id=SeAuditPrivilege]
audit = enabled

[privilege_id=SeSecurityPrivilege]
audit = enabled


###### Security: Logon/Logoff ######
[eventtype=windows_logoff]
access = enabled
stop = enabled
logoff = enabled

[eventtype=windows_logon_explicit]
authentication = enabled
privileged = enabled

[eventtype=windows_logon_failure]
authentication = enabled

[app=win%3Alocal]
local = enabled

[app=win%3Aremote]
remote = enabled

[eventtype=windows_logon_success]
authentication = enabled

[Logon_Type=8]
cleartext = enabled


###### Security: Object Access ######
[eventtype=windows_object_open]
resource = enabled
file = enabled
access = enabled
start = enabled

[eventtype=windows_handle_closed]
resource = enabled
file = enabled
access = enabled
stop = enabled


###### Security: Policy Change ######
[eventtype=windows_audit_policy_change]
policy = enabled
configuration = enabled
modify = enabled
audit = enabled
change = enabled

[eventtype=windows_security_access_granted]
access = enabled
authorization = enabled
add = enabled
change = enabled
account = enabled

[eventtype=windows_security_access_removed]
access = enabled
authorization = enabled
delete = enabled
change = enabled
account = enabled

[eventtype=windows_audit_policy_changed]
policy = enabled
configuration = enabled
modify = enabled
audit = enabled
change = enabled

[eventtype=windows_firewall_policy_active]
application = enabled
firewall = enabled
configuration = enabled
report = enabled

[eventtype=windows_firewall_policy_change]
application = enabled
firewall = enabled
configuration = enabled
modify = enabled

[eventtype=windows_firewall_port_listening]
application = enabled
firewall = enabled
port = enabled
listening = enabled
report = enabled


###### Security: Privilege Use ######
[eventtype=windows_special_privileges]
authentication = enabled
privileged = enabled

[eventtype=windows_privileged_service_call]
process = enabled
execute = enabled
start = enabled
privileged = enabled

[eventtype=windows_privileged_object_operation]
resource = enabled
execute = enabled
start = enabled
privileged = enabled


###### Security: Process Tracking ######
[eventtype=windows_process_new]
process = enabled
execute = enabled
start = enabled

[eventtype=windows_process_exit]
process = enabled
execute = enabled
stop = enabled

[eventtype=windows_process_token]
process = enabled
execute = enabled
start = enabled
privileged = enabled

[Token_Elevation_Type_id=2]
privileged = enabled


###### Security: System ######
[eventtype=windows_auth_package]
process = enabled
execute = enabled
start = enabled

[eventtype=windows_logon_process]
process = enabled
authorization = enabled
add = enabled

[eventtype=windows_notification_package]
process = enabled
execute = enabled
start = enabled


###### Security: Vulnerability ######
[eventtype=windows_security_misconfiguration_password_minimum_length]
misconfiguration = enabled
password = enabled
policy = enabled
vulnerability = enabled
report = enabled
audit = enabled
change = enabled


###### System: Time ######
[eventtype=windows_time_sync]
report = enabled
time = enabled
synchronize = enabled
success = enabled
performance = enabled

[eventtype=windows_time_failure]
report = enabled
time = enabled
synchronize = enabled
failure = enabled
performance = enabled


###### System: Update ######
[eventtype=windows_system_update]
system = enabled
update = enabled

[eventtype=windows_system_update_status]
status = enabled

[eventtype=windows_updatelog]
system = enabled
update = enabled

[eventtype=windows_updatelog_status]
status = enabled

## WMI:Update
[eventtype=wmi_installed_packages]
system = enabled
update = enabled
status = enabled


###### Splunk WMI ######

## ComputerSystem
[eventtype=wmi_computersystem]
performance = enabled
memory = enabled

## CPUTime
[eventtype=perfmon_cputime]
cpu = enabled
report = enabled
performance = enabled
oshost = enabled

[eventtype=perfmon_cputime_anomalous]
anomalous = enabled

[eventtype=wmi_cputime]
cpu = enabled
report = enabled
performance = enabled

[eventtype=wmi_cputime_anomalous]
anomalous = enabled

## System
[eventtype=perfmon_system]
cpu = enabled
report = enabled
performance = enabled
oshost = enabled

## Disk
[eventtype=perfmon_freediskspace]
disk = enabled
report = enabled
performance = enabled
storage = enabled
oshost = enabled

[eventtype=perfmon_freediskspace_anomalous]
anomalous = enabled

[eventtype=wmi_freediskspace]
disk = enabled
report = enabled
performance = enabled
storage = enabled

[eventtype=wmi_freediskspace_anomalous]
anomalous = enabled

[eventtype=perfmon_logicaldisk]
disk = enabled
performance = enabled
storage = enabled
oshost = enabled

[eventtype=wmi_logicaldisk]
disk = enabled
performance = enabled
storage = enabled

## Network
[eventtype=perfmon_network]
network = enabled
performance = enabled
oshost = enabled

[eventtype=perfmon_network_throughput]
network = enabled
performance = enabled
oshost = enabled

[eventtype=perfmon_network_bandwidth]
network = enabled
performance = enabled
oshost = enabled

[eventtype=wmi_network_throughput]
network = enabled
performance = enabled

[eventtype=wmi_network_bandwidth]
network = enabled
performance = enabled

## Process
[eventtype=perfmon_process]
performance = enabled
process = enabled
oshost = enabled
report = enabled

## Listening Ports
[eventtype=script_listeningports]
port = enabled
listening = enabled
report = enabled

## Local Processes
[eventtype=wmi_localprocesses]
process = enabled
report = enabled

[eventtype=wmi_localprocesses_anomalous]
anomalous = enabled

## Memory
[eventtype=perfmon_memory]
memory = enabled
report = enabled
performance = enabled
oshost = enabled

[eventtype=perfmon_memory_anomalous]
anomalous = enabled

[eventtype=wmi_memory]
memory = enabled
report = enabled
performance = enabled

[eventtype=wmi_memory_anomalous]
anomalous = enabled

## Service
[eventtype=wmi_service]
service = enabled
report = enabled

[eventtype=wmi_service_status_anomalous]
anomalous = enabled

[eventtype=wmi_service_state_anomalous]
anomalous = enabled

[app=W32Time]
time = enabled
synchronize = enabled

[app=wuauserv]
automatic = enabled
update = enabled

## Uptime
[eventtype=wmi_uptime]
uptime = enabled
report = enabled
performance = enabled

[eventtype=wmi_uptime_anomalous]
anomalous = enabled

## User Accounts
[eventtype=wmi_useraccounts]
account = enabled
report = enabled

inventory = enabled
user = enabled

## Version
[eventtype=wmi_version]
system = enabled
version = enabled
report = enabled

inventory = enabled


[eventtype=windows_account_mapped]
authentication = enabled

[eventtype=windows_account_notmapped]
authentication = enabled

[eventtype=microsoft_windows_hostmon_process]
process = enabled
report = enabled

[eventtype=microsoft_windows_hostmon_service]
service = enabled
report = enabled

[eventtype=microsoft_windows_hostmon_service_time]
time = enabled
synchronize = enabled
os = enabled
performance = enabled

## Endpoint.processes Data Model
[eventtype=windows_endpoint_processes]
process = enabled
report = enabled

## Endpoint.services Data Model
[eventtype=windows_endpoint_services]
service = enabled
report = enabled

## Security-CIM Mappings

## Endpoint Registry Data Model
[eventtype=windows_security_endpoint_registry]
endpoint = enabled
registry = enabled

## Endpoint Port Data Model
[eventtype=windows_security_endpoint_port]
listening = enabled
port = enabled

## Change Audit Data Model
[eventtype=windows_security_change_audit]
change = enabled
audit = enabled

## Change Data Model
[eventtype=windows_security_change]
change = enabled

# Authentication Data Model
[eventtype=windows_security_authentication]
authentication = enabled

[eventtype=windows_security_change_account]
change = enabled
account = enabled

# Change Audit DM for Windows System
[eventtype=windows_system_change_audit]
change = enabled
audit = enabled

# Network resolution (dns) DM for DNS events.
[eventtype=nt6-dns-events]
network = enabled
resolution = enabled
dns = enabled
