Collecting logs from Siemens SIMATIC PCS 7 and sending them to Microsoft Azure Sentinel could be a complex task because of the unique combination of log source and the desired destination. In this post we will take a look at how you can forward log data from Siemens SIMATIC PCS 7 to Microsoft Azure Sentinel by incorporating the NXLog log collection tool.
Siemens SIMATIC PCS 7 is a distributed control system (DCS) solution that uses a large number of Siemens hardware components supported and configured by PCS 7 software tools. Deployments usually consist of Engineering stations (ES), Operating Stations (OS), and Automation stations (AS). The PCS 7 AS comprises the Siemens SIMATIC S7-400 series central processing unit, typical use of which is the automation of plants that require a large number of I/O signals and control loops. SIMATIC PCS 7 is commonly used for various automation tasks in industrial sectors such as chemicals, petrochemicals, water treatment, pharmaceuticals and power generation.
SCADA systems and Siemens share a couple of things in common: they employ a variety of network protocols to facilitate communication between various type of nodes (physical computers, CPUs, distributed I/Os, as well as field devices) and SCADA for storing data. Consequently, both solutions are firmly integrated within the corporate networks where those nodes are deployed.
SIMATIC PCS 7 produces a wide variety of logs about its operation. Some of the logs are available through Windows Event Log, but most of the logs are stored as flat files.
Because of the nature and size of the systems controlled by Siemens SIMATIC PCS 7, continuous and safe operation is a must with no room for errors or trade-offs. The logs produced by SIMATIC PCS 7 can provide crucial information about the operation of the entire system it controls. However, the inconsistent formatting and the noisiness of the logs could present some challenges.
NXLog Enterprise Edition is a lightweight, modular log collection tool, capable of tackling the most demanding cases log collection may pose. It possesses a wide range of features that enable it to parse almost any format to produce structured data for further processing. For these reasons, it is the perfect tool for monitoring and collecting SIMATIC PCS 7 logs.
- Collecting SIMATIC PCS 7 logs from Windows Event Log
Windows Event Log is the main log aggregation framework for the Windows platform. The logs created by SIMATIC PCS 7 contain PC station, NET configuration, and adapter operation related information, as well as information about various other services.
- Collecting SIMATIC PCS 7 logs from file
File-based PCS7 logs include WinCC system diagnostics logs, SQL Server logs of WinCC, OS project logs, AS project logs, Multiproject logs as well as Batch logs coming from Automation, Engineering, and Operator stations.
The easiest way to collect and normalize Siemens SIMATIC PCS 7 log data is to collect them with NXLog. With its unique capabilities, logs can be collected from literally any file, in any format. Given the wide variation in format and structure of such log files, its versatility is ideally suited for these systems.
For more information on how to integrate NXLog with SIMATIC PCS 7, you can find detailed documentation here.
The above mentioned log sources, and the features NXLog provides all play an important role when normalizing logs in order to be accepted by Microsoft Azure Sentinel.
Azure Sentinel is a SIEM solution offered as a scalable, cloud-native, service within Microsoft Azure. Its main features are security analytics, alert detection, threat intelligence, and threat response. With the comprehensive view of your enterprise’s network security environment that it provides, the response time needed to assess and respond to possible security threats can be greatly reduced.
- Log sources
To forward logs to Azure Sentinel from NXLog you should already have a Microsoft Azure Sentinel subscription. Then, you can create a Log Analytics workspace for storing your log data, queries, and functions. By configuring NXLog with your Log Analytics workspace ID, your primary (or secondary) key, and a table name for storing the logs, it can connect to Azure Sentinel, convert any log source on the fly to the format Azure Monitor requires, and finally send the log data securely for ingestion as custom log events. Using the Azure Sentinel dashboard, you can view those ingested events by navigating to General > Overview > Logs. Under the Tables tab, your custom logs will appear with the same table name you chose while configuring NXLog.
Forwarding logs to Azure Sentinel is straightforward with NXLog. All it takes is following a few simple configuration steps.