# Please set SIEM to the IP address of your Logsign SIEM
define SIEM 10.10.2.51
define PORT 514

# Please set ROOT to the folder your nxlog was installed into
#define ROOT C:\Program Files\nxlog
#define ROOT_STRING C:\Program Files\nxlog
define ROOT C:\Program Files\nxlog
define ROOT_STRING C:\Program Files\nxlog

# Define certs if used during Sensor Logger creation
define CERTDIR %ROOT%\cert
define CONFDIR  %ROOT%\\conf

# Define internal log details for NXLog
define LOGDIR   %ROOT%\data
define LOGFILE  %LOGDIR%\nxlog.log 
 
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
#LogFile %ROOT%\data\nxlog.log
LogFile %LOGFILE%


<Extension json>
    Module xm_json
</Extension>
 
<Extension syslog>
    Module xm_syslog
</Extension>

<Extension File operations>
    Module xm_fileop 
</Extension>

#####################################################
############    Windows Core Event Logs   ###########
#################       START      ##################
#################      0 tasks     ##################
#####################################################
<Input lgs_eventlog>
    Module im_msvistalog
    # Prevent endless loop due to 5156 logging nxlog.exe connections
    Exec if ($SourceName == 'Microsoft-Windows-Security-Auditing' and $EventID IN (5156, 5157) and $Application =~ /\\nxlog\.exe$/i) drop();
    # Define Queries
    Query       <QueryList>\
                        <Query Id="0">\
                            <Select Path="Application">*</Select>\
                            <Select Path="System">*</Select>\
                            <Select Path="Security">*</Select>\
                            <Select Path="Setup">*</Select>\
			                <Select Path="Microsoft-Windows-AppLocker/EXE and DLL">*</Select>\
                            <Select Path="Microsoft-Windows-AppLocker/MSI and Script">*</Select>\
                            <Select Path="Microsoft-Windows-AppLocker/Packaged app-Deployment">*</Select>\
                            <Select Path="Microsoft-Windows-AppLocker/Packaged app-Execution">*</Select>\
                            <Select Path="Microsoft-Windows-LSA/Operational">*</Select>\
                            <Select Path="Microsoft-Windows-NTLM/Operational">*</Select>\
                            <Select Path="Microsoft-Windows-PowerShell/Admin">*</Select> \
                            <Select Path="Microsoft-Windows-Powershell/Operational">*</Select> \
                            <Select Path="Microsoft-Windows-PrintService/Admin">*</Select> \
                            <Select Path="Microsoft-Windows-PrintService/Operational">*</Select> \
                            <Select Path="Microsoft-Windows-TaskScheduler/Operational">*</Select> \
                            <Select Path="Microsoft-Windows-TerminalServices-LocalSessionManager/Operational">*</Select> \
                            <Select Path="Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational">*</Select> \
                            <Select Path="Windows PowerShell">*</Select> \
                            <Suppress Path="Security">*[System[(EventID=4689 or EventID=5158 or EventID=5440 or EventID=5444)]]</Suppress> \
                            <Suppress Path="Windows PowerShell">*[System[(EventID=501 or EventID=400 or EventID=600)]]</Suppress> \
                        </Query>\
                    </QueryList> 
    
    # Filter out by Application

    Exec if ($Application =~ /nxlog\\nxlog.exe/) drop();
    # Filter out by Source and Destination IP   
    Exec if ($SourceAddress =~ /224.0.0.252/) drop();
    Exec if ($SourceAddress =~ /192.168.1.255/) drop();
    Exec if ($SourceAddress =~ /224.0.0.1/) drop();
    Exec if ($SourceAddress =~ /239.255.255.250/) drop();
    Exec if ($DestAddress =~ /224.0.0.22/) drop();
    # Filter out by Command Line    
    Exec if ($CommandLine =~ /"C:\\Program Files \(x86\)\\nxlog\\nxlog.exe" -c "C:\\Program Files \(x86\)\\nxlog\\conf\\nxlog.conf"/) drop();
    # Dropping non-security but often-loud logs for DFS and failed ISATAP issues
    Exec if ($EventID == 4202 or $EventID == 4208 or $EventID == 4302 or $EventID == 4304 or $EventID == 5004) drop();\
    # Workaround for local time so as to standardize to absolute microseconds since epoch
    # Filtering \r\n\t characters and commas from 4656 logs.
    Exec if ($EventID == 33205 ) drop();
    Exec if ($EventID == 4656 or $EventID == 4663 or $EventID == 5140 or $EventID == 5145 ) $AccessList = replace($AccessList, "\r\n\t\t\t\t", ","); 
    Exec if ($EventID == 4656 or $EventID == 4663 or $EventID == 5140 or $EventID == 5145 ) $AccessList = replace($AccessList, "%%", "");
    Exec $EventTime = integer($EventTime);
    # JSON is required because some Windows logs contain new-line characters.
    <Exec>  
        $Message = replace($Message, "\t", " "); 
$Message = replace \
        ($Message, "\n", " "); $Message = replace($Message, "\r", " "); 
        $Message = to_json();      
        $raw_event = $Message;
        to_syslog_bsd();
    </Exec>
</Input>
<Output lgs_out_eventlog>
    Module om_udp
    Host %SIEM%
    Port %PORT%
    Exec  $SyslogFacility = 'LOCAL0'; to_syslog_bsd();
</Output>

<Route route_eventlog>
    Path lgs_eventlog => lgs_out_eventlog
</Route>
#####################################################
############    Windows Core Event Logs   ###########
#################         END      ##################
#####################################################

#####################################################
#################  SYSMON Event Logs ################
#################       START      ##################
#################      2 tasks     ##################
#####################################################
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
# Tasks:
# 1) Install Sysmon on your endpoints if you intend to use this feature
#
# https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
#
#
# 2) If you want to utilize Sysmon Logging 
# remove all # at the beginning of lines from 
# <Input lgs_eventlog_sysmon> to </Route> after route_eventlog_sysmon in this section
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#
<Input lgs_eventlog_sysmon>
    Module im_msvistalog
    Query       <QueryList>\
                        <Query Id="0">\
                            <Select Path="Microsoft-Windows-Sysmon/Operational">*</Select>\
                        </Query>\
                    </QueryList> 
           
    # Workaround for local time so as to standardize to absolute microseconds since epoch
    Exec $EventTime = integer($EventTime);
    # JSON is required because some Windows logs contain new-line characters.
    <Exec>
        $Message = replace($Message, "\t", " "); $Message = replace \
        ($Message, "\n", " "); $Message = replace($Message, "\r", " "); 
        $Message = to_json();      
        $raw_event = $Message;
        to_syslog_bsd();
    </Exec>
</Input>
<Output lgs_out_eventlog_sysmon>
    Module om_udp
    Host %SIEM%
    Port %PORT%
    Exec  $SyslogFacility = 'LOCAL0'; to_syslog_bsd();
</Output>

<Route route_eventlog_sysmon>
    Path lgs_eventlog_sysmon => lgs_out_eventlog_sysmon
</Route>
#####################################################
#################  SYSMON Event Logs ################
#################        END       ##################
#####################################################


#####################################################
#################  DHCP Event Logs ##################
#################      START       ##################
#####################################################

# This section will be used for forwading DHCP logs
<Input dhcp_input>
    Module      im_file
# The following line should be edited for the path where the DHCP logs are kept.          
    File        "C:\\Windows\\Sysnative\\dhcp\\DhcpSrvLog-*.log"  
    Exec        $Message=$raw_event; $SyslogFacility = 'LOCAL1';
</Input>

<Output dhcp_out>
   Module      om_udp
    Host %SIEM%
    Port %PORT%
   Exec        to_syslog_bsd();
</Output>

<Route dhcp_site1>
    Path        dhcp_input => dhcp_out
</Route>

#####################################################
#################  DHCP Event Logs ##################
#################        END       ##################
#####################################################


#####################################################
#################  IIS Event Logs  ##################
#################      START       ##################
#####################################################

# This section will be used for forwad IIS logs
# Parcel rule definition for IIS logs. The fields content should be updated according to the columns opened in the IIS file.
<Extension w3c>
    Module xm_csv
    Fields $date, $time, $s_ip, $cs_method, $cs_uri_stem, $cs_uri_query, $s_port, $cs_username, $c_ip, $cs_User_Agent, $cs_Referer, $sc_status, $sc_substatus, $sc_win32_status, $time_taken, $X-Forwarded-For
	
    FieldTypes string, string, string, string, string, string, integer, string, string, string, string, integer, integer, integer, integer, string
    Delimiter ' '
</Extension>

# Lines starting with hash are not imported in IIS files
<Input IIS_Site1>
    Module    im_file
# The following line must be edited for the IIS file path
    File    "C:\\inetpub\\logs\\LogFiles\\\\u_ex*"
    SavePos  TRUE

    Exec if $raw_event =~ /^#/ drop();              \
       else                         \
       {                            \
            w3c->parse_csv();                    \
            $EventTime = parsedate($date + " " + $time);  \
            $SourceName = "IIS";              \
            $raw_event = to_json();             \
       }
</Input>

<Output IIS_Site1_out>
   Module      om_udp
    Host %SIEM%
    Port %PORT%
   Exec        $SyslogFacility = 'LOCAL2'; $Message = to_json(); to_syslog_bsd();
</Output>

<Route IIS_Site1>
    Path        IIS_Site1 => IIS_Site1_out
</Route>
#####################################################
#################  IIS Event Logs  ##################
#################      END         ##################
#####################################################

#####################################################
#################  Exchange Event Logs  #############
#################      START       ##################
#####################################################
# This section will be used for forwarding Exchange Message Tracking logs
# Parcel rule definition for Message Tracking logs. The content of fields should be updated according to the columns opened in the Message Tracking file. The definition below is the definition for Exchange 2016
<Extension exchange>
    Module      xm_csv
	Fields $date-time,$client-ip,$client-hostname,$server-ip,$server-hostname,$source-context,$connector-id,$source,$event-id,$internal-message-id,$message-id,$network-message-id,$recipient-address,$recipient-status,$total-bytes,$recipient-count,$related-recipient-address,$reference,$message-subject,$sender-address,$return-path,$message-info,$directionality,$tenant-id,$original-client-ip,$original-server-ip,$custom-data,$transport-traffic-type,$log-id,$schema-version
    Delimiter   ,
</Extension>

# Lines starting with a hash are dropped
<Input Exchange_Site1>
    Module      im_file
# The following path definition should be arranged for Message Tracking log files
    File        'D:\\TransportRoles\\Logs\MessageTracking\\MSGTRK*'
	
	Exec if $raw_event =~ /^#/ drop();              \
       else                         \
       {                            \
            exchange->parse_csv();                    \
            $EventTime = parsedate($date + " " + $time);  \
            $SourceName = "EXCHANGE";              \
            $raw_event = to_json();             \
       }
</Input>

<Output Exchange_Site1_out>
   Module      om_udp
    Host %SIEM%
    Port %PORT%
   Exec        $SyslogFacility = 'LOCAL3'; $Message = to_json(); to_syslog_bsd();
</Output>

<Route Exchange_Site1>
    Path        Exchange_Site1 => Exchange_Site1_out
</Route>

#####################################################
#################  Exchange Event Logs  #############
#################      END         ##################
#####################################################

#####################################################
#################  DNS Event Logs   #################
#################      START         ################
#####################################################
# This section will be used for routing DNS logs
define EMPTY_EVENT_REGEX /(^$|^\s+$)/
define NOT_STARTING_WITH_DATE_REGEX /^(?!\d+\/\d+\/\d+).+/

<Input dns>
    Module      im_file
# Edit the following line for the DNS file path
    File        "C:\\Windows\\Sysnative\\dns\\dns.log"  
	SavePos TRUE
    ReadFromLast TRUE
    PollInterval 1
	<Exec>
        # empty lines are dropped
        if $raw_event =~ %EMPTY_EVENT_REGEX% drop();
        # date ile baslamayan satirlar droplanir
        if $raw_event =~ %NOT_STARTING_WITH_DATE_REGEX% drop();
    </Exec>
</Input>

<Output out_dns>
  Module om_udp
    Host %SIEM%
    Port %PORT%
  Exec $SyslogFacility = 'LOCAL4'; to_syslog_bsd();
</Output>

<Route dns>
    Path        dns => out_dns
</Route>

#####################################################
#################  DNS Event Logs   #################
#################      END         ##################
#####################################################


#####################################################
#################  FTP Event Logs   #################
#################      START         ################
#####################################################
<Input ftp>
    Module    im_file
    File    "C:\Program Files (x86)\FileZilla Server\Logs\fzs*"
    SavePos  TRUE
 
    Exec if $raw_event =~ /^#/ drop();              \
       else                         \
       {                            \
            w3c->parse_csv();                    \
            $EventTime = parsedate($date + " " + $time);  \
            $SourceName = "powershell";              \
            $raw_event = to_json();             \
       }
</Input>

<Output ftp_out>
   Module om_udp
    Host %SIEM%
    Port %PORT%
   #Please note that if you do not see the IIS logs in Log Search, you will need to uncomment the line below.  
   #The Generic Syslog event source requires that the logs have a syslog header, as specified by RFC3164.  This will add the required RFC3164 syslog header to the logs.
  #Exec         to_syslog_bsd();
</Output>

<Route ftp>
    Path        ftp => ftp_out
</Route>


#####################################################
#################  FTP Event Logs   #################
#################      END           ################
#####################################################

#####################################################
#################  WAMP Event Logs  #################
#################      START         ################
#####################################################

<Input wamp>
    Module    im_file
    File    "C:\\wamp64\\logs\\*log*"
    SavePos  TRUE
 
    Exec if $raw_event =~ /^#/ drop();              \
       else                         \
       {                            \
            w3c->parse_csv();                    \
            $EventTime = parsedate($date + " " + $time);  \
            $SourceName = "wamp";              \
            $raw_event = to_json();             \
       }
</Input>


<Output wamp_out>
   Module      om_udp
    Host %SIEM%
    Port %PORT%
   #Please note that if you do not see the IIS logs in Log Search, you will need to uncomment the line below.  
   #The Generic Syslog event source requires that the logs have a syslog header, as specified by RFC3164.  This will add the required RFC3164 syslog header to the logs.
  #Exec         to_syslog_bsd();
</Output>


<Route wamp>
    Path        wamp => wamp_out
</Route>

#####################################################
#################  WAMP Event Logs  #################
#################      END           ################
#####################################################


#####################################################
#################  TOMCAT Event Logs  ###############
#################      START         ################
#####################################################

<Input tomcat>
    Module    im_file
    File    "C:\\apachetomcat8\\logs\\*access*"
    SavePos  TRUE
 
    Exec if $raw_event =~ /^#/ drop();              \
       else                         \
       {                            \
            w3c->parse_csv();                    \
            $EventTime = parsedate($date + " " + $time);  \
            $SourceName = "tomcat";              \
            $raw_event = to_json();             \
       }
</Input>


<Output tomcat_out>
   Module      om_udp
    Host %SIEM%
    Port %PORT%
   #Please note that if you do not see the IIS logs in Log Search, you will need to uncomment the line below.  
   #The Generic Syslog event source requires that the logs have a syslog header, as specified by RFC3164.  This will add the required RFC3164 syslog header to the logs.
  #Exec         to_syslog_bsd();
</Output>


<Route tomcat>
    Path        tomcat => tomcat_out
</Route>


#####################################################
#################  TOMCAT Event Logs  ###############
#################      END           ################
#####################################################


#####################################################
#################          MSSQL Logs    #####################
#################              START           #####################
#####################################################
<Input MSSQL_IN>
Module	im_msvistalog
SavePos	FALSE
ReadFromLast	TRUE

Query	<QueryList> \
<Query Id="0">  \
<Select Path="Application">*[System[(EventID='33205')]]</Select>\
</Query>  \
</QueryList>
Exec	$Message = $raw_event;
Exec	if $raw_event =~ /^#/ drop();\
Else\
{\
$SourceName = "MSSQL-NXLOG";\
}
Exec	if $raw_event =~ /action_id:(\S+)/ $Action_ID = $1;
Exec	if $raw_event =~ /database_name:(\S+)/ $DataBase = $1;
Exec	if $raw_event =~ /server_instance_name:(\S+)/ $SV_Instace = $1;
Exec	if $raw_event =~ /session_server_principal_name:(\S+)/ $User = $1;
Exec	 if $raw_event =~ /AUDIT_SUCCESS/\
{\
$Result = 'Success';\
}\
else\
$Result = 'Failure';
Exec            $Message = replace($Message, "\t", " "); $Message = replace($Message, "\n", " "); $Message = replace($Message, "\r", " ");
Exec $Message = to_json();
</Input>

<Output MSSQL_OUT>
Module	om_udp
Host	%SIEM%
Port	%PORT%
Exec	$SyslogFacility = 'LOCAL5'; to_syslog_bsd();
</Output>

<Route mssql>
Path	MSSQL_IN => MSSQL_OUT
</Route>
#####################################################
#################          MSSQL Logs    #####################
#################              END               #####################
#####################################################