Hello there! I was wondering how one can forward the raw XML events (open Event Viewer, double click an event, click Details, then XML View) from the Windows Event Log to a SIEM/log file using nxlog EE.

Currently, if I don't specify any options, it ends up in a log format that isn't XML, and if I use

Exec $Message = to_xml(); to_syslog_bsd();

then I get an XML that isn't formatted the same way as the Windows Event XML, which confuses the SIEM.

Thank you!

As an aside, this is what I want:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <TimeCreated SystemTime="2021-06-25T08:54:27.604250100Z" />
    <Correlation />
    <Execution ProcessID="592" ThreadID="3300" />
    <Security />
    <Data Name="param1">Client License Service (ClipSVC)</Data>
    <Data Name="param2">running</Data>
AskedJune 25, 2021 - 10:58am

Answer (1)

You should be able to use only to_xml() to forward the logs to your SIEM, have you tried this and if so does it work, or is it being parsed differently by the SIEM?