forwarding IIS logs
Hi all, I'm using CE edition and sending logs to Taegis XDR, I've followed the instructions at this page: Microsoft IIS (secureworks.com)
Configured IIS per these instructions: https://docs.ctpx.secureworks.com/integration/connectEndpoint/microsoft_iis_connect/#configuring-microsoft-iis-logging
Configured nxlog.conf per these instructions: https://docs.ctpx.secureworks.com/integration/connectEndpoint/microsoft_iis_connect/#configuring-nxlog
Logs are still not showing up, and I think I have this section in the nxlog.conf IIS config misconfigured with the IP of my Taegis CDR collecter. I've got the IP of my host entered into the HOST line, and the port entered into the PORT line. Am I supposed to comment out any of the ‘Module’ lines? Do I have it misconfigured below? Any help is appreciated, thank you in advance.
<Output W3SVCOUT> Module om_udp Module om_tcp### Guidance on TLS/SSL configuration - https://nxlog.co/documentation/nxlog-user-guide/om_ssl.html Module om_ssl Host x.x.x.x Port 601 CAFile %CERTDIR%\CA.cer CertFile %CERTDIR%\winhost.cer CertKeyFile %CERTDIR%\winhost.key AllowUntrusted FALSE
Indeed only one module is allowed per configuration block, so in the W3SVCOUT Output you need to decide which of the modules you'll keep based on the protocol that your target (Taegis) is expecting on that port. You can comment out the others.
There is a typo in the original link you've provided. The original Secureworks template can be found at: https://docs.ctpx.secureworks.com/integration/connectEndpoint/nxlog_WEL.txt
For example if you need TCP the output block should look like so:
## Module om_udp
### Guidance on TLS/SSL configuration - https://nxlog.co/documentation/nxlog-user-guide/om_ssl.html
## Module om_ssl
## CAFile %CERTDIR%\CA.cer
## CertFile %CERTDIR%\winhost.cer
## CertKeyFile %CERTDIR%\winhost.key
## AllowUntrusted FALSE
### Create our RFC3164 compliant syslog line and transmit on local5.info
Exec $SyslogFacilityValue = 21;$Hostname=hostname_fqdn();$Severity = 'INFO';to_syslog_bsd();
I hope this helps.
If you'd be interested to try the NXLog Enterprise Edition, please note that during the 30-day full-featured trial we can assist you on a presales level. If you later decide to purchase there are several support tier options you can chose from.