Did you know that there's an alternative to Sysmon? A product that comes with Sysmon and Sigma rule converters, that excels with a graphical rule editor, and uses a simple yet powerful query language instead of XML. Oh, and it offers sophisticated application monitoring for all Windows and macOS endpoints including Citrix, too. This product is uberAgent ESA. Dominik Britz (Customer Success Engineer at vast limits) presents its capabilities in this session

Ingest Action - Ingest actions allows users to rapidly author, preview and deploy transformation rules at ingest-time with an intuitive user interface. Customers will also now be able to instantly route data to external S3-compliant destinations for archival or audit purposes, With Ingest Actions, users can focus on bringing their high value data to Splunk, and ensure that data is available at the right time, in the right places, and in the right structure.