• Introduction
• Tools Used
• Approach to Problem
• Learning Outcomes
• Final Grade Received
• References

The premise of this project is to create a custom windows event in which it will be forwarded to Splunk for further analysis. The final report will be linked in the References section.

The tools used here are the following:

1. Splunk
2. Splunk Universal Forwarder
3. Oracle VM VirtualBox
4. Windows 10 ISO

1. Create a Windows event using PowerShell by using the EventLog functions.
2. Forward to Splunk using the Splunk Universal Forwarder.
3. Search the windows event in Splunk by using the EventID that was created in step #1.

1. Understood how Splunk Universal Forwarder works.
2. Understood different types of searching mechanisms in Splunk such as using regular expression, strings, boolean conditions, by events, by patterns, etc.
3. Understood how to manipulate fields such as adding and deleting selected fields and interesting fields.

100%

Written report linked here