Skip to content

Latest commit

 

History

History
70 lines (49 loc) · 1.99 KB

README.md

File metadata and controls

70 lines (49 loc) · 1.99 KB
Raw

IrisEVTXModule

An interface module for Evtx2Splunk and Iris in order to ingest Microsoft EVTX log files. The module is installed on IRIS by default. In case you needed a procedure to install it by yourself, you can follow the one below.

How to install

Install evtx2splunk

  • Fetch the remote repository AND checkout the branch called release_irisevtxmodule
$ git clone https://github.com/whikernel/evtx2splunk
$ cd evtx2splunk
$ git checkout release_irisevtxmodule
  • Install its requirements and the package itself in your IRIS Python environment
$ source /somewhere/iris_venv/bin/activate
(iris_venv) $ pip install .
  • Copy the evtxdump_binaries in your IRIS instance
(iris_venv) $ cp -R ./evtxdump_binaries /better/path/accessible/from/iris/instance/
  • Modify the file evtxdump_binaries/event_bind.json accordingly to point to the binaries (prefer absolute path)

Then install IrisEVTXModule package : iris_evtx

  • Fetch the remote repository
$ git clone https://github.com/Iris-Tim/IrisEVTXModule
  • Install iris_evtx module in your IRIS Python environment
$ source /somewhere/iris_venv/bin/activate
(iris_venv) $ cd IrisEVTXModule
(iris_venv) $ pip install .

How to import in IRIS instance

  • Log-in to your IRIS web instance
  • Go to "Manage" -> "Advanced" -> "Modules" configuration page
  • Add Module
  • In the module name text field, set iris_evtx
  • If the import was successful, a new line should appear showing a new module named "Evtx2Splunk"

How to configure the module in IRIS instance

  • On the Modules page, click on Evtx2Splunk, and configure at least all the necessary fields

How to use the Evtx2Splunk module

  • (Temporary) Restart Iris instance in order to update the available pipelines
  • Go to Manage Case
  • Create or update a case
  • Pick EVTX files, or archive containing EVTX files
  • Set Splunk index and optionnaly a hostname
  • Import

License

The contents of this repository is available under LGPL3 license.