Project 13: Splunk (10 points)

What You Need for this Project

A Windows computer, real or virtual. Any version should work--I used Windows 10 TP.

Purpose

Splunk is a security tool that aggregates log data from applications, servers, and network devices. In this project, we'll use it to examine the activity on a single Windows machine.

Dowloading Splunk

In a Web browser, go to http://www.splunk.com/download

In the "splunk>enterprise" section, click the "Free Download" button, as shown below.

If you are using Windows, click Windows, as shown below.

In S214, we're using 32-bit Windows 7, so click the link for the x86 version, as shown below.

Installing Splunk Enterprise

When the .msi file downloads, double-click it and install the software with the default options.

Starting Splunk

A Web browser opens with the Splunk "First time signing in?" page, as shown below.

On the next page, enter a new password into both boxes. For this project, I recommend P@ssw0rd

Adding Data Sources

In the Splunk page, , click "Add Data", as shown below.

The "Add data" page opens, as shown below.

Click monitor.

On the left side, click "Local Performance Monitoring", as shown below.

In the right pane of the page, make these selections, as shown below:

Collection name: CPU
Available objects: Processor information
Selected counters: % Processor Time
Selected instances: _Total
Polling interval: 10

At the top of the page, click the green Next button.

In the "Input Settings" page, click the green Review button.

In the Review page, click the green Submit button.

A page appears saying "Local performance monitoring input has been created successfully", as shown below.

Click "Add more data".

Click monitor.

On the left side, click "Local Event Logs".

In the right pane, select these three logs, as shown below:

Application
System
Security

At the top of the page, click the green Next button.

In the "Input Settings" page, click the green Review button.

In the Review page, click the green Submit button.

Searching the Data

Click "Start searching".

In the "New Search" page, enter a search string of splunk as shown below.

At the top right, click the magnifying glass to perform the search.

You should see results, showing events about "splunk", as shown below.

Saving the Screen Image

Make sure you can see at least one result, showing an event about "splunk".

Save a FULL DESKTOP image with the filename Proj 13 from Your Name.

Turning in Your Project

Send the image as an email attachment to cnit.120@gmail.com with a Subject line of Proj 13 from Your Name.

Reference

http://www.sans.org/reading-room/whitepapers/logging/discovering-security-events-interest-splunk-34272

Revised 4-5-15 by Sam Bowne