Teamviewer Add-on for Splunk

The TeamViewer Add-on for Splunk collects and parses TeamViewer log files from Windows endpoints, enabling monitoring and security analysis of remote access sessions. The add-on ingests log data from TeamViewer 15.x installations, including session logs, network connection reports, and audit data. It provides field extractions that map TeamViewer events to the Common Information Model (CIM), specifically the Authentication, Network Sessions, Network Traffic, and Data Access data models. The add-on defines two source types: teamviewer for general session and audit logs, and teamviewer:network for network connection details. By normalizing TeamViewer data into CIM-compliant fields, the add-on enables correlation with other security data sources and supports use cases such as remote access auditing, connection monitoring, and security investigations involving remote support sessions.