Microsoft AppLocker Content Pack

The following content pack is available for use with a Graylog Illuminate license and Graylog Enterprise or Graylog Security. Contact sales to learn more about obtaining Illuminate.

Microsoft AppLocker is an optional security feature that helps organizations control which applications and files users can run, including executables, dynamic-link libraries (DLLs), scripts, installers, and packaged applications.

Supported Version(s)

• Windows 8 or later, though we recommended Windows 10 or 11 or Server 2022+

Hint: Microsoft AppLocker feature availability is highly dependent on the Windows edition and version in use. Please refer to the Microsoft documentation for detailed requirements.

Requirements

• Graylog 6.0.1+ with a valid Enterprise license

• Microsoft AppLocker policies must be enabled and rules created via Group Policy or Local Security Policy

Stream Configuration

This technology pack includes 1 stream:

• Illuminate:Windows AppLocker Event Log Messages

Hint: If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index Set Configuration

This technology pack includes 1 index set definition:

• Windows AppLocker Event Log Messages

Hint: If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created with retention settings of a daily rotation and 90 days of retention. These settings can be adjusted as required after installation.

Log Collection

The following log delivery agents are supported:

• Winlogbeat

• NXLog Enterprise Edition

• NXLog Community Edition (limited support)

Graylog Sidecar Example Configuration

Please refer to the official documentation to set up Graylog Sidecar.

1. Create a Beats input for Winlogbeat or a GELF input for NXLog in Graylog. When sending to a Beats input, ensure that the option Do not add Beats type as prefix is disabled.

2. Create an API access token and a custom configuration for your chosen log delivery agent.

3. See the following example configuration for Winlogbeat:

   Copy

   # Needed for Graylog
   fields_under_root: true
   fields.collector_node_id: ${sidecar.nodeName}
   fields.gl2_source_collector: ${sidecar.nodeId}
   
   output.logstash:
   hosts: ["${user.graylog_host}:5044"]
   path:
   data: ${sidecar.spoolDir!"C:\\Program Files\\Graylog\\sidecar\\cache\\winlogbeat"}\data
   logs: ${sidecar.spoolDir!"C:\\Program Files\\Graylog\\sidecar"}\logs
   tags:
   - windows
   winlogbeat:
   event_logs:
   - name: "Microsoft-Windows-AppLocker/EXE and DLL"
   ignore_older: 24h
   - name: "Microsoft-Windows-AppLocker/MSI and SCRIPT"
   ignore_older: 24h
   - name: "Microsoft-Windows-AppLocker/Packaged app-Deployment"
   ignore_older: 24h
   - name: "Microsoft-Windows-AppLocker/Packaged app-Execution"
   ignore_older: 24h

4. See the following example configuration for NXLog:

   Copy

   define ROOT C:\Program Files (x86)\nxlog
   
   Moduledir %ROOT%\modules
   CacheDir %ROOT%\data
   Pidfile %ROOT%\data\nxlog.pid
   SpoolDir %ROOT%\data
   LogFile %ROOT%\data\nxlog.log
   LogLevel INFO
   
   <Extension logrotate>
   Module  xm_fileop
   <Schedule>
   When    @daily
   Exec    file_cycle('%ROOT%\data\nxlog.log', 7);
   </Schedule>
   </Extension>
   
   <Extension gelfExt>
   Module xm_gelf
   # Avoid truncation of the short_message field to 64 characters.
   ShortMessageLength 65536
   </Extension>
   
   <Input eventlog>
   Module im_msvistalog
   PollInterval 1
   SavePos True
   ReadFromLast True
   
   <QueryXML>
   <QueryList>
   <Query Id='1'>
   <Select Path="Microsoft-Windows-AppLocker/EXE and DLL">*</Select>
   <Select Path="Microsoft-Windows-AppLocker/MSI and Script">*</Select>
   <Select Path="Microsoft-Windows-AppLocker/Packaged app-Deployment">*</Select>
   <Select Path="Microsoft-Windows-AppLocker/Packaged app-Execution">*</Select>
   </Query>
   </QueryList>
   </QueryXML>
   </Input>
   
   <Output gelf>
   Module om_tcp
   Host ${user.graylog_host}
   Port 12201
   OutputType  GELF_TCP
   <Exec>
   # These fields are needed for Graylog
   $gl2_source_collector = '${sidecar.nodeId}';
   $collector_node_id = '${sidecar.nodeName}';
   </Exec>
   </Output>
   
   <Route route-1>
   Path eventlog => gelf
   </Route>

5. Install Graylog Sidecar on the client host.

6. Edit the Graylog Sidecar client configuration with your Graylog server API URL and API access token.

Hint: This configuration requires NXLog to be installed in C:\Program Files (x86) xlog and not in the default folder.

Hint: NXLog Community Edition does not send the RuleAndFileData XML portion of the event. This suppressed event data contains key fields that are important for effective Microsoft AppLocker activity monitoring. Due to this limitation, we recommend you use NXLog Enterprise or Winlogbeat instead.

What is Provided

• Parsing rules to extract Microsoft AppLocker event logs into schema compatible fields.

• Illuminate spotlight highlighting security events and statistics of interest.

Events Processed by This Technology Pack

The Microsoft AppLocker content pack supports the following event IDs. Generic processing will be provided for event IDs not listed.

Event IDs

Parsed Fields

Microsoft AppLocker Content Pack

Microsoft AppLocker offers a dashboard with 6 tabs:

Overview

EXE

DLL

MSI

SCRIPT

APPX