Microsoft Windows Security Content Pack

The following content pack is available for use with a Graylog Illuminate license and Graylog Enterprise or Graylog Security. Contact sales to learn more about obtaining Illuminate.

This technology pack processes Windows Security event logs, providing normalization and enrichment of common events of interest. In addition, it identifies all Windows logs that have not been processed by any other technology pack, normalizes common event log fields, and indexes these messages in a separate index.

This content pack also includes a supplemental processing pack, Microsoft Windows Security Message Size Reduction, that you can enable to reduce storage requirements for processes Windows Security logs.

Supported Versions

• Currently supported versions of the Windows operating system

Requirements

• Winlogbeat v 8.x or NXLog Enterprise 3.2 / NXLog Community Edition 2.10

• When using the Winlogbeat agent, the beats type prefix should be enabled

Stream Configuration

This technology pack includes 2 streams:

• Illuminate:Windows Security Event Log Messages: Contains all messages from the Windows Security event log.
• Illuminate:Windows Event Log Messages: Contains all event log messages that have not been processed by this or any other technology pack.

Hint: If this stream does not exist prior to the activation of this pack then it is created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index Set Configuration

This technology pack includes 2 index set definitions:

• Windows Security Event Log Messages: Contains all messages from the Windows Security event log.
• Windows Event Log Messages: Contains all event log messages not processed by this or any other technology pack.

Hint: If this index set is already defined, then nothing is changed. If this index set does not exist, then it is created with retention settings of a daily rotation and 90 days of retention. These settings can be adjusted as required after installation.

Log Collection

The following log delivery agents are supported:

• Winlogbeat 8.x

• NXLog Enterprise Edition 3.2

• NXLog Community Edition 2.10

Graylog Sidecar Configuration

Please refer to the official documentation to set up Graylog Sidecar.

1. Create a Beats input for Winlogbeat or a GELF input for NXLog in Graylog. When sending to a Beats input, ensure that the option Do not add Beats type as prefix is disabled.

2. Create an API access token and a custom configuration for your chosen log delivery agent.

3. See the following example configuration for Winlogbeat:

   Copy

   winlogbeat:
                       event_logs:
                       - name: Security

4. See the following example configuration for NXLog:

   Copy

   <Input eventlog>
                       Module im_msvistalog
                       PollInterval 1
                       SavePos False
                       ReadFromLast True
                       <QueryXML>
                       <QueryList>
                       <Query Id='1'>
                       <Select Path='Security'>*</Select>
                       </Query>
                       </QueryList>
                       </QueryXML>
                       </Input>

5. Install Graylog Sidecar on the client host.

6. Edit the Graylog Sidecar client configuration with your Graylog server API URL and API access token.

What Is Provided

• Parsing and normalization to extract Windows event logs into Graylog schema compatible fields

• Graylog Information Model categorization of messages

Events Processed by This Technology Pack

The Windows Security technology pack applies normalization of common event log fields to all Windows event log messages. See the tables below for the full list of normalized fields, processed event IDs, and GIM categorization assignments.

Event IDs

Parsed Fields

GIM Categorization

GIM categorization is provided for the following messages: