Using NXLog to Netwitness
jwilliams1010
Hi,
The decoders used in Netwitness. The job of a decoder is to select a parser to parse log files.
The Netwitness LogDeconder shows Service Type as unknown but I was expecting to see winevent_snare.
My NXLog config uses the Exec $Message =~ s/(\t|\R)/ /g; to_syslog_snare(); to send windows log data to the NETWITNESS collector/decoder.
The problem is the decoder is using unknown or rxlinux as service type not winevent_snare to parse my windows log files. I was looking for the decoder to use winevent_snare but it is not.
Does anyone have a working NXLog config file to collect windows event logs to Netwitness?
Thanks for you assistance, Jim
