Sysmon v7.01 and Schema 4.00 about sysmon-splunk-app HOT 6 CLOSED

Hmm yes. I'll begin testing now.

from sysmon-splunk-app.

I seem to have gotten it working but it required using the Universal Forwarder with "Forwarding and receiving" configured with a receive port rather than the "Data Inputs" method which works if the only thing you're doing is forwarding Sysmon.

I updated a couple of fields such as "Computer" which is "ComputerName" and I'm running Swift's configuration with the new schema.

from sysmon-splunk-app.

Interesting.

I just checked my lab -

System Monitor v7.01 - System activity monitor
Copyright (C) 2014-2018 Mark Russinovich and Thomas Garnier
Sysinternals - www.sysinternals.com
<manifest schemaversion="4.0" binaryversion="1.01">
  <configuration>

Things are working good with the latest app I'm working on. I'll upgrade Splunk and confirm again before submitting latest to Git soon.

from sysmon-splunk-app.

I do see Computer now. I'll make sure things are updated

from sysmon-splunk-app.

If you have the ability, try this out with some data - https://github.com/MHaggis/sysmon-splunk-app/tree/App-v2
It's been working fine for me the last few days.

from sysmon-splunk-app.

I went ahead and merged. See Master Branch

from sysmon-splunk-app.