Microsoft Certificates Add-On for Splunk®
The Microsoft Certificates add-on for Splunk® provides functionality to ingest certificate information from the certificate store on Windows servers and workstations. The add-on also allows the collection of certificate information for issued certificates from Microsoft Certificate Servers.
PowerShell execution policy must allow the execution of scripts on servers where data will be collected.
Install the add-on on all search heads, install on all Windows forwarders where certificate data is to be collected.
The add-on is provided with two default inputs, which are disabled by default. It is recommended this inputs in this file be used as a template to configure inputs on forwarders as needed. See example inputs below:
[powershell://CertStore-CA-Issued]
disabled = 1
script = . "$SplunkHome\etc\apps\TA_microsoft_certificates\bin\Get-CAIssuedCertificates.ps1"
schedule = 0 15 * * 0-6
sourcetype = windows:certstore:ca:issued
index = win_certstore_data
The example input above will collect issued certificates information from the local CA.
[powershell://CertStore-Local]
disabled = 1
script = . "$SplunkHome\etc\apps\TA_microsoft_certificates\bin\Get-LocalStoreCertificates.ps1"
schedule = 0 15 * * 0-6
sourcetype = windows:certstore:local
index = win_certstore_data
The example input above will collect certificate information from the local certificate store. The default is to recurse through all containers.
Enabling PowerShell Execution Policy
about-execution-policies
set-executionpolicy
Also, for those who may be new to PowerShell getting-started-with-windows-powershell
Version | Changes |
0.1.0 | Initial Release |
0.1.1 | Update app.conf naming and spelling issue |