Filtering to specific logs | Log collection solutions

#1 jborn2305 7 years ago

All,

I'm somewhat new to Netwrix, and I need some help understanding how I can send ONLY specific logs up to our SEIM. I've dug through the documentation a bit, and will continue to do so. I'm sure someone on here can whip up a quick response...

Here is my config file, please help me with mocking up a config that will only send up events 4648 and 4624...

## This is a sample configuration file. See the nxlog reference manual about the
## configuration options. It should be installed locally and is also available
## online at http://nxlog.org/docs/

## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.

#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension syslog>
Module xm_syslog
</Extension>

<Input internal>
Module im_internal
</Input>

<Input eventlog>
Module im_msvistalog

</Input>

<Output out>
    Module      om_udp
    Host        xx.yy.zz.xyz
    Port        514
    Exec        to_syslog_snare();
</Output>

<Route 1>
Path eventlog, internal => out
</Route>

Permalink

#2 b0ti Nxlog ✓ 7 years ago

#1 jborn2305

All, I'm somewhat new to Netwrix, and I need some help understanding how I can send ONLY specific logs up to our SEIM. I've dug through the documentation a bit, and will continue to do so. I'm sure someone on here can whip up a quick response... Here is my config file, please help me with mocking up a config that will only send up events 4648 and 4624... ## This is a sample configuration file. See the nxlog reference manual about the ## configuration options. It should be installed locally and is also available ## online at http://nxlog.org/docs/ ## Please set the ROOT to the folder your nxlog was installed into, ## otherwise it will not start. #define ROOT C:\Program Files\nxlog define ROOT C:\Program Files (x86)\nxlog Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data LogFile %ROOT%\data\nxlog.log <Extension syslog> Module xm_syslog </Extension> <Input internal> Module im_internal </Input> <Input eventlog> Module im_msvistalog </Input> <Output out> Module om_udp Host xx.yy.zz.xyz Port 514 Exec to_syslog_snare(); </Output> <Route 1> Path eventlog, internal => out </Route>

> I'm somewhat new to Netwrix

Wrong forums then ;)

Try adding something like this:

<Exec>
   if not ($EventID IN (4242, 4243, 142) and ($Channel == "Security")) drop();
</Exec>

You can also use the XPath based filtering with the QueryXML configuration option. You can test and copy the XML from Event Viewer.

See the "Collecting Windows Security Audit Log data with NXLog and Sysmon" article that discusses a similar use-case.