IrisEVTXModule

An interface module for Evtx2Splunk and Iris in order to ingest Microsoft EVTX log files. The module is installed on IRIS by default. In case you needed a procedure to install it by yourself, you can follow the one below.

How to install

Install evtx2splunk

• Fetch the remote repository AND checkout the branch called release_irisevtxmodule

$ git clone https://github.com/whikernel/evtx2splunk
$ cd evtx2splunk
$ git checkout release_irisevtxmodule

• Install its requirements and the package itself in your IRIS Python environment

$ source /somewhere/iris_venv/bin/activate
(iris_venv) $ pip install .

• Copy the evtxdump_binaries in your IRIS instance

(iris_venv) $ cp -R ./evtxdump_binaries /better/path/accessible/from/iris/instance/ 

• Modify the file evtxdump_binaries/event_bind.json accordingly to point to the binaries (prefer absolute path)

Then install IrisEVTXModule package : iris_evtx

• Fetch the remote repository

$ git clone https://github.com/Iris-Tim/IrisEVTXModule

• Install iris_evtx module in your IRIS Python environment

$ source /somewhere/iris_venv/bin/activate
(iris_venv) $ cd IrisEVTXModule
(iris_venv) $ pip install .

How to import in IRIS instance

• Log-in to your IRIS web instance
• Go to "Manage" -> "Advanced" -> "Modules" configuration page
• Add Module
• In the module name text field, set iris_evtx
• If the import was successful, a new line should appear showing a new module named "Evtx2Splunk"

How to configure the module in IRIS instance

• On the Modules page, click on Evtx2Splunk, and configure at least all the necessary fields

How to use the Evtx2Splunk module

• (Temporary) Restart Iris instance in order to update the available pipelines
• Go to Manage Case
• Create or update a case
• Pick EVTX files, or archive containing EVTX files
• Set Splunk index and optionnaly a hostname
• Import

License

The contents of this repository is available under LGPL3 license.