How to forward the raw XML for Windows logs
ryanswj
Hello there! I was wondering how one can forward the raw XML events (open Event Viewer, double click an event, click Details, then XML View) from the Windows Event Log to a SIEM/log file using nxlog EE.
Currently, if I don't specify any options, it ends up in a log format that isn't XML, and if I use
Exec $Message = to_xml(); to_syslog_bsd();
then I get an XML that isn't formatted the same way as the Windows Event XML, which confuses the SIEM.
Thank you!
As an aside, this is what I want:
7036
0
4
0
0
0x8080000000000000
718
System
Lab-NXServer
Client License Service (ClipSVC)
running
43006C00690070005300560043002F0034000000