splunk-sysmon-ta-setup

What problem does it solve?

The Splunk Add-on for Microsoft Sysmon Setup automates the end-to-end onboarding, configuration, and validation of Sysmon data ingestion, reducing manual steps and drift across endpoints and collectors.

Core Features & Use Cases

• Render endpoint or Windows Event Collector inputs and corresponding CIM/props stanzas.
• Create the Sysmon index, install/roll out the add-on, and validate data ingestion end-to-end.
• Enforce guardrails to prevent duplicate ingestion by ensuring only one mode (endpoint or WEC) is active per population, and verify readiness against the Sysmon source.
• Validate source-constrained Sysmon data in the target index and provide preflight and post-deployment checks.

Quick Start

Render the Sysmon TA deployment plan and inputs, then review and run validation to confirm the Sysmon data path is configured correctly.