From 19bd2fd7362dd286c6da6393dfd64b493804b2bb Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 13 Dec 2021 18:00:14 -0500 Subject: [PATCH] updating sysmon macro --- macros/sysmon.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/macros/sysmon.yml b/macros/sysmon.yml index fb5503662c..17fdbd53e0 100644 --- a/macros/sysmon.yml +++ b/macros/sysmon.yml @@ -1,4 +1,4 @@ -definition: sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +definition: sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=Syslog:Linux-Sysmon/Operational description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. name: sysmon