- Introduction
- Deployment
- Configuration
- OS Support
- Integration
- 42. Amazon Web Services (AWS)
- 43. Apache HTTP Server
- 44. Apache Tomcat
- 45. APC Automatic Transfer Switch
- 46. Apple macOS kernel
- 47. ArcSight Common Event Format (CEF)
- 48. Box
- 49. Brocade Switches
- 50. Browser History Logs
- 51. Check Point
- 52. Cisco ACS
- 53. Cisco ASA
- 54. Cisco FireSIGHT
- 55. Cisco IPS
- 56. Cloud Instance Metadata
- 57. Common Event Expression (CEE)
- 58. Dell EqualLogic
- 59. Dell iDRAC
- 60. Dell PowerVault MD Series
- 61. Devo
- 62. DHCP logs
- 63. DNS Monitoring
- 64. Docker
- 65. Elasticsearch and Kibana
- 66. F5 BIG-IP
- 67. File Integrity Monitoring
- 68. FreeRADIUS
- 69. Graylog
- 70. HP ProCurve
- 71. IBM QRadar SIEM
- 72. Industrial Control Systems
- 73. Linux Audit System
- 74. Linux system logs
- 75. Log Event Extended Format (LEEF)
- 76. McAfee Enterprise Security Manager (ESM)
- 77. McAfee ePolicy Orchestrator
- 78. Microsoft Active Directory Domain Controller
- 79. Microsoft Azure
- 80. Microsoft Azure Event Hubs
- 81. Microsoft Azure Sentinel
- 82. Microsoft Exchange
- 83. Microsoft IIS
- 84. Microsoft SharePoint
- 85. Microsoft SQL Server
- 86. Microsoft System Center Endpoint Protection
- 87. Microsoft System Center Configuration Manager
- 88. Microsoft System Center Operations Manager
- 89. MongoDB
- 90. Nagios Log Server
- 91. Nessus Vulnerability Scanner
- 92. NetApp
- 93. .NET application logs
- 94. Nginx
- 95. Okta
- 96. Osquery
- 97. Postfix
- 98. Promise
- 99. Rapid7 InsightIDR SIEM
- 100. RSA NetWitness
- 101. SafeNet KeySecure
- 102. Salesforce
- 103. Snare
- 104. Snort
- 105. Solarwinds Loggly
- 106. Splunk
- 107. Sumo Logic
- 108. Symantec Endpoint Protection
- 109. Synology DiskStation
- 110. Syslog
- 111. Sysmon
- 112. Ubiquiti UniFi
- 113. VMware vCenter
- 114. Windows AppLocker
- 115. Windows Command Line Auditing
- 116. Windows Event Log
- 117. Windows Firewall
- 118. Windows Group Policy
- 119. Windows Management Instrumentation (WMI)
- 120. Windows PowerShell
- 121. Microsoft Windows Update
- 122. Windows USB auditing
- 123. Zeek (formerly Bro) Network Security Monitor
- Troubleshooting
- Enterprise Edition Reference Manual
- NXLog Manager
- NXLog Add-Ons
75. Log Event Extended Format (LEEF)
NXLog Enterprise Edition can be configured to collect or forward logs in the LEEF format.
The LEEF log format is used by IBM Security QRadar products and supports Syslog as a transport. It describes an event using key-value pairs, and provides a list of predefined event attributes. Additional attributes can be used for specific applications.
SYSLOG_HEADER LEEF_HEADER|EVENT_ATTRIBUTES
The LEEF_HEADER part contains the following pipe-delimited fields.
-
LEEF version
-
Vendor
-
Product name
-
Product version
-
Event ID
-
Optional delimiter character, as the character or its hexadecimal value prefixed by
0x
orx
(LEEF version 2.0)
The EVENT_ATTRIBUTES part contains a list of key-value pairs separated by a tab or the delimiter specified in the LEEF header.
Oct 11 11:27:23 myserver LEEF:Version|Vendor|Product|Version|EventID|Delimiter|src=192.168.1.1⇥dst=10.0.0.1
75.1. Collecting LEEF logs
NXLog Enterprise Edition can parse LEEF logs with the xm_leef module’s parse_leef() procedure.
With the following configuration, NXLog will accept LEEF logs via TCP, convert them to JSON, and output the result to file.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
<Extension _json>
Module xm_json
</Extension>
<Extension _leef>
Module xm_leef
</Extension>
<Input in>
Module im_tcp
Host 0.0.0.0
Port 1514
Exec parse_leef();
</Input>
<Output out>
Module om_file
File '/var/log/json'
Exec to_json();
</Output>
Oct 11 11:27:23 myserver LEEF:2.0|Microsoft|MSExchange|2013 SP1|15345|src=10.50.1.1⇥dst=2.10.20.20⇥spt=1200
{
"EventReceivedTime": "2016-10-11 11:27:24",
"SourceModuleName": "in",
"SourceModuleType": "im_file",
"Hostname": "myserver",
"LEEFVersion": "LEEF:2.0",
"Vendor": "Microsoft",
"SourceName": "MSExchange",
"Version": "2013 SP1",
"EventID": "15345"
}
75.2. Generating LEEF logs
NXLog Enterprise Edition can also generate LEEF logs, using the to_leef() procedure provided by the xm_leef extension module.
With this configuration, NXLog will parse the input JSON format from file and forward it as LEEF via TCP.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
<Extension _json>
Module xm_json
</Extension>
<Extension _leef>
Module xm_leef
</Extension>
<Input in>
Module im_file
File '/var/log/json'
Exec parse_json();
</Input>
<Output out>
Module om_tcp
Host 10.12.0.1
Port 514
Exec to_leef();
</Output>
{
"EventTime": "2016-09-13 11:23:11",
"Hostname": "myserver",
"Purpose": "test",
"Message": "This is a test log message."
}
<13>Sep 13 11:23:11 myserver LEEF:1.0|NXLog|in|3.0.1775|unknown|EventReceivedTime=2016-09-13 11:23:12⇥SourceModuleName=in⇥SourceModuleType=im_file⇥devTime=2016-09-13 11:23:11⇥identHostName=myserver⇥Purpose=test⇥Message=This is a test log message.⇥devTimeFormat=yyyy-MM-dd HH:mm:ss