I'm somewhat new to Netwrix, and I need some help understanding how I can send ONLY specific logs up to our SEIM.  I've dug through the documentation a bit, and will continue to do so.  I'm sure someone on here can whip up a quick response...

Here is my config file, please help me with mocking up a config that will only send up events 4648 and 4624...

## This is a sample configuration file. See the nxlog reference manual about the

## configuration options. It should be installed locally and is also available

## online at http://nxlog.org/docs/

## Please set the ROOT to the folder your nxlog was installed into,

## otherwise it will not start.

#define ROOT C:\Program Files\nxlog

define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules

CacheDir %ROOT%\data

Pidfile %ROOT%\data\nxlog.pid

SpoolDir %ROOT%\data

LogFile %ROOT%\data\nxlog.log

<Extension syslog>

    Module xm_syslog


<Input internal>

    Module im_internal


<Input eventlog>

    Module im_msvistalog


<Output out>

    Module      om_udp

    Host        xx.yy.zz.xyz

    Port        514

    Exec        to_syslog_snare();


<Route 1>

    Path        eventlog, internal => out



AskedOctober 17, 2016 - 6:56pm

Answer (1)

> I'm somewhat new to Netwrix

Wrong forums then ;)

Try adding something like this:

   if not ($EventID IN (4242, 4243, 142) and ($Channel == "Security")) drop();

You can also use the XPath based filtering with the QueryXML configuration option. You can test and copy the XML from Event Viewer.

See the "Collecting Windows Security Audit Log data with NXLog and Sysmon" article that discusses a similar use-case.


Comments (1)