103. Snare

Table of Contents

The Snare Agent is a popular log collection software for Windows Event Log. The Snare format is supported by many tools and SIEM vendors. It uses tab delimited records and can use Syslog as the transport. NXLog can be configured to collect or forward logs in the Snare format.

The Snare format can be used with or without the Syslog header.

Snare format

HOSTNAME⇥MSWinEventLog⇥Criticality⇥EventLogSource⇥SnareCounter⇥SubmitTime⇥EventID⇥SourceName⇥UserName⇥SIDType⇥EventLogType⇥ComputerName⇥CategoryString⇥DataString⇥ExpandedString⇥OptionalMD5Checksum

"Snare Over Syslog" format

<PRI>TIMESTAMP HOSTNAME MSWinEventLog⇥Criticality⇥EventLogSource⇥SnareCounter⇥SubmitTime⇥EventID⇥SourceName⇥UserName⇥SIDType⇥EventLogType⇥ComputerName⇥CategoryString⇥DataString⇥ExpandedString⇥OptionalMD5Checksum

103.1. Collecting Snare logs

NXLog can parse Snare logs with the parse_csv() procedure provided by the xm_csv extension module.

Example 471. Using xm_csv to capture Snare logs

With the following configuration, NXLog will accept Snare format logs via UDP, parse them, convert to JSON, and output the result to file. This configuration supports both "Snare over Syslog" and the regular Snare format.

nxlog.conf


  1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

  <Extension snare>
    Module      xm_csv
    Fields      $MSWINEventLog, $Criticality, $EventLogSource, $SnareCounter, \
                $SubmitTime, $EventID, $SourceName, $UserName, $SIDType, \
                $EventLogType, $ComputerName, $Category, $Data, $Expanded, \
                $MD5Checksum
    FieldTypes  string, integer, string, integer, datetime, integer, string, \
                string, string, string, string, string, string, string, string
    Delimiter   \t
</Extension>

<Extension json>
    Module      xm_json
</Extension>

<Extension syslog>
    Module      xm_syslog
</Extension>

<Input in>
    Module      im_udp
    Host        0.0.0.0
    Port        6161
    <Exec>
        parse_syslog_bsd();
        if $Message =~ /^((\w+)\t)?(MSWinEventLog.+)$/
        {
            if $2 != ''
            {
                $Hostname = $2;
                $Message = $3;
            }
            snare->parse_csv($Message);
            $Message = $Expanded;
        }
    </Exec>
</Input>

<Output out>
    Module      om_file
    File        '/var/log/json'
    Exec        to_json();
</Output>

<Route r>
    Path        in => out
</Route>

Input sample ("Snare Over Syslog")

<13>Nov 21 11:40:27 myserver MSWinEventLog⇥0⇥Security⇥32⇥Mon Nov 21 11:40:27 2016⇥592⇥Security⇥Andy⇥User⇥Success Audit⇥MAIN⇥DetailedTracking⇥Process ended⇥Ended process ID: 2455

Output sample

{
  "EventReceivedTime": "2016-11-21 11:40:28",
  "SourceModuleName": "in",
  "SourceModuleType": "im_file",
  "SyslogFacilityValue": 1,
  "SyslogFacility": "USER",
  "SyslogSeverityValue": 5,
  "SyslogSeverity": "NOTICE",
  "SeverityValue": 2,
  "Severity": "INFO",
  "Hostname": "myserver",
  "EventTime": "2016-11-21 11:40:27",
  "Message": "Ended process ID: 2455",
  "MSWINEventLog": "MSWinEventLog",
  "Criticality": 0,
  "EventLogSource": "Security",
  "SnareCounter": 32,
  "SubmitTime": "2016-11-21 11:40:27",
  "EventID": 592,
  "SourceName": "Security",
  "UserName": "Andy",
  "SIDType": "User",
  "EventLogType": "SuccessAudit",
  "ComputerName": "MAIN",
  "CategoryString": "DetailedTracking",
  "DataString": "Process ended",
  "ExpandedString": "Ended process ID: 2455"
}

103.2. Generating Snare logs

NXLog can also generate Snare logs in place of the original Snare agent with the to_syslog_snare() procedure provided by the xm_syslog extension module.

Example 472. Sending Windows Event Log in Snare format

With this configuration, NXLog will read the Windows Event Log, convert it to Snare format, and output it via UDP. NXLog log messages are also included (via the im_internal module). Tabs and newline sequences are replaced with spaces.

nxlog.conf


  1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

  <Extension syslog>
    Module  xm_syslog
</Extension>

<Input internal>
    Module  im_internal
</Input>

<Input eventlog>
    Module  im_msvistalog
    Exec    $Message =~ s/(\t|\R)/ /g;
</Input>

<Output out>
    Module  om_udp
    Host    192.168.1.1
    Port    514
    Exec    to_syslog_snare();
</Output>

<Route r>
    Path    internal, eventlog => out
</Route>

Output sample

<13>Nov 21 11:40:27 myserver MSWinEventLog⇥0⇥Security⇥32⇥Mon Nov 21 11:40:27 2016⇥592⇥Security⇥N/A⇥N/A⇥Success Audit⇥MAIN⇥DetailedTracking⇥Process ended⇥Ended process ID: 2455

You are here

103. Snare | Log Collection Solutions

103. Snare

103.1. Collecting Snare logs

103.2. Generating Snare logs