In this article:
To configure a collector server in the domain controller and push logs from all endpoints and servers to that collector instance where we install NXLogs and process them to the chronicle forwarder.
- Windows AD Environment
- 1 x Winserver which acts as a collector needs to be installed in the AD.
- Endpoint devices.
Setting up the collector
- Please setup a windows server and join it to the AD.
- Once setup and logged in, open the windows event viewer.
- Double click Subscriptions, if you are opening subscriptions for the first time. A dialog box opens, press Yes and Continue.
- Open PowerShell as admin and run the following commands. These commands are to start winrm, and at make winrm persistent at startup. The other commands are recommended by Microsoft to maintain stable and reliable connection to all computers in the domain using WinRM.
Command -- winrm quickconfig -quiet
Set-Service -Name WINRM -StartupType Automatic
netsh http delete urlacl url=http://+:5985/wsman/
netsh http add urlacl url=http://+:5985/wsman/
netsh http delete urlacl url=https://+:5986/wsman/
netsh http add urlacl url=https://+:5986/wsman/
- Now lets go back to the windows event viewer and go to Subscriptions and create a new subscription.
- Give the subscription name and note it down somewhere.
- In the same dialog box, there are two methods in which logs are collected by the collector. Collector Initiated, which doesn’t scale well in which the collector server contacts the endpoints and collects logs. Source Initiated in which the source computers contact the collector to send logs.
- For medium to small deployments, Source initiated is preferable.
- Now click Computer Groups and select Add domain computers. Type in the dialog box, the DC/Endpoint names and press check names. If they are existing and connected to the AD , the name will be auto completed. Press OK.
- Now under Subscription Properties, click Select Events, (select all the events as you wish) and in the same dialog box, there is a drop-down menu where you select the types of event logs and press OK.
- Now select Advanced in the subscription properties and select Minimize Latency and press OK.
- The collector server is now ready to receive logs.
Updating the Group Policy
- Now that we have our collector setup, we need to create a group policy which lets the endpoints and servers in that domain to push logs to the collector server.
- Please login to the ad/dc machine and open Group Policy Management.
- Under the Domain, select the Forest, and select the Domains and select your particular domain. For Example, I created it as WECTEST.
- Right click the newly created GPO and select Edit.
- Under Computer Management, go to Policies, select Windows Settings --> Security Settings.
- Right click the Restricted Group box and press Add Group.
- In the dialog box, enter Event Log Readers Group by pressing browse and in the object names to and press OK.
- Double click the newly created event log readers group which will open the properties for that group. Here click Add and in the add member dialog box type “NT AUTHORITY\Network Service ”.
- Now click on system services which is right under the Restricted Groups. Find Windows Remote Management and double click to define it and select Automatic and press OK.
- Next navigate to Administrative Templates, select Windows Components --> Event Forwarding and double click Configure Forwarder Resource Usage. Press Enable and under options select 1000.
Note: This value is usually scaled from deployment to deployment.
- Next click Configure Target Subscription Manager, press Enabled and under options select Show.
A dialog box will appear in which we have to give value that is pointing to the collector.
syntax = Server=http://your DC server address:5985/wsman/SubscriptionManager/WEC,Refresh=120. Now press Apply and OK.
- Next go to the Event log service, then Security, double click Configure log access, press Enabled and paste the following ACL in the dialog box ACL-- O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;S-1-5-20).
- Now right click the new Group Policy created and press Enforce.
- Next head over to the collector machine and check our subscription that we have created.
- Now under Windows logs, go to Forwarded Events and check if you are receiving events.
- Since the GPO was updated successfully and we can see that windows event forwarding is working. We will install nx log on the collector machine and route the logs to the forwarder.
Installing NX Log
- Install NXLog. Follow the NXLog documentation.
- First, download the NXLog MSI file from the NXLog website.
- Log in to your account, then click My account at the top of the page.
- Under the Downloads > NXLog Enterprise Edition files tab, choose the correct package for your system.
- Once the file is downloaded, follow the below steps.
- Right click and click Install.
- Click Next.
- Next accept the terms in the license agreement and click Next.
- In this step we can select default path or custom path where the NX log has to be installed and click Next.
- Click Install.
- Click Finish.
- Go to the NX log installation path and open the config file.
Eg :- C:\Program Files\nxlog\conf (Default Installation Path)
- Create a configuration file for NXLog. Use im_msvistalog input module for Microsoft Windows server security channel logs. Replace <hostname> and <port> values with information about the central Microsoft Windows or Linux server. See the NXLog documentation for information about the om_tcp module.
define ROOT C:\Program Files\nxlog
define WINEVTLOG_OUTPUT_DESTINATION_ADDRESS <hostname>
define WINEVTLOG_OUTPUT_DESTINATION_PORT <port>
define CERTDIR %ROOT%\cert
define CONFDIR %ROOT%\conf\nxlog.d
define LOGDIR %ROOT%\data
define LOGFILE %LOGDIR%\nxlog.log
Exec $EventTime = integer($EventTime) / 1000;
Exec $EventReceivedTime = integer($EventReceivedTime) / 1000;
Path windows_security_eventlog => out_chronicle_windevents
AutodetectCharsets iso8859-2, utf-8, utf-16, utf-32
# Check the size of our log file hourly, rotate if larger than 5MB
Every 1 hour
Exec if (file_exists('%LOGFILE%') and \
(file_size('%LOGFILE%') >= 5M)) \
# Rotate our log file every week on Sunday at midnight
Exec if file_exists('%LOGFILE%') file_cycle('%LOGFILE%', 8);
# Snare compatible example configuration
# Collecting event log
# <Input in>
# Module im_msvistalog
# Converting events to Snare format and sending them out over TCP syslog
# <Output out>
# Module om_tcp
# Host 192.168.1.1
# Port 514
# Exec to_syslog_snare();
# Connect input 'in' to output 'out'
# <Route 1>
# Path in => out
- Now Start the NXLog service.
You will be receiving the logs to the forwarder at this point.
Please sign in to leave a comment.