NXLog TLS (Secure Log Forwarding) Configuration Guide for Logsign

This document explains step-by-step how to configure the NXLog service and the Logsign SIEM platform to ensure that logs from your Windows servers are securely forwarded (via TLS/SSL) to the Logsign SIEM.

Nxlog Installation: https://support.logsign.net/hc/en-us/articles/5785027953426-NXLog-Configuration

Step 1: Generating Test Certificates (If You Do Not Have Existing Certificates)

To forward logs securely, you need .pem (Certificate) and .key (Private Key) files. If you do not have an existing PKI/CA infrastructure, you can quickly generate test certificates on Windows using Git Bash, which includes OpenSSL.

Please note that the third-party software suggested in this guide (such as Git Bash and OpenSSL) is provided merely as a recommendation to facilitate the certificate generation process. The downloading, installation, and usage of any external software are entirely at your own discretion and responsibility.
 

1. Install Git: Go to [https://gitforwindows.org/](https://gitforwindows.org/), download Git Bash, and complete the installation using the default settings.
2. Create a Working Directory: Create an empty folder named Certificates on your Desktop (or any preferred location).
3. Launch Git Bash: Open the folder you just created, right-click on an empty space, and select "Open Git Bash here" (For Windows 11, you may need to click "Show more options" first).
4. Certificate Generation Commands: Copy and paste the following commands one by one into the black terminal window (You can use Shift + Insert or Right-click > Paste). Press Enter after each command:

openssl genrsa -out ca.key 2048

openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 -out ca.pem -subj "//CN=LogsignTestCA"

openssl genrsa -out client.key 2048

openssl req -new -key client.key -out client.csr -subj "//CN=NXLogClient"

openssl x509 -req -in client.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out client.pem -days 3650 -sha256

After running these commands, three new files named ca.pem, client.key, and client.pem will be generated in your folder.

Step 2: Configuring NXLog (On the Windows Server)

1. Copy the ca.pem, client.key, and client.pem files you generated.
2. Paste these files into the cert folder inside the NXLog installation directory. This path is usually: C:\Program Files\nxlog\cert.
3. Run Notepad as Administrator and open the NXLog configuration file (usually located at C:\Program Files\nxlog\conf\nxlog.conf).
4. Backup and delete (Or modify if needed) the entire existing content, paste the custom configuration provided below, and save the file. (Note: The configuration file is provided at the bottom of this document.)
5. Open the Windows services.msc (Services) snap-in from the Start menu, locate the nxlog service, and click Restart.
6. Important: Ensure that your Windows Firewall and any intermediate security devices allow traffic over TCP port 6514 towards the Logsign IP address.

Step 3: Configuring Logsign

To receive these encrypted logs, you need to configure the corresponding device source on Logsign to support TLS.

1. Log in to the Logsign SIEM web interface.
2. Navigate to Settings > Data Collection.
3. Click the Add New Source button and select "Syslog" (or the appropriate profile for your device type).
4. Devices: Syslog
5. Vendor List: NXLog
6. Product: Windows Agent
7. IP: Windows server's IP address.
8. Mark: "TLS Enabled"
9. Fill out the certificate fields as follows:
   • Certificate Crt Field: Open your client.pem file with Notepad. Copy all the text inside (including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines) and paste it into this field.
   • Certificate Key Field: Open your client.key file with Notepad. Copy all the text inside (including the -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- lines) and paste it into this field.
10. If Logsign only receives Windows Core Events and Sysmon logs, Syslog Facility can be "any".
11. If Logsign also receives other kind of logs like MSSQL, Exchange, etc. update the NXLog configuration file accordingly and add those devices as a new log data source form Settings > Data Collection.
12. Click Save to complete the process. Logs will now start flowing securely to the Logsign SIEM platform.

Updated nxlog.conf Content:

Please change 10.10.10.10 for Logsign IP address.

This one is for Windows Core Events and Sysmon. Remove the entire Sysmon section if it's not installed.

# Please set SIEM to the IP address of your Logsign SIEM

define SIEM 10.10.10.10

define PORT 6514

# Please set ROOT to the folder your nxlog was installed into

#define ROOT C:\Program Files\nxlog

#define ROOT_STRING C:\Program Files\nxlog

define ROOT C:\Program Files\nxlog

define ROOT_STRING C:\Program Files\nxlog

# Define certs if used during Sensor Logger creation

define CERTDIR %ROOT%\cert

define CONFDIR  %ROOT%\conf

# Define internal log details for NXLog

define LOGDIR   %ROOT%\data

define LOGFILE  %LOGDIR%\nxlog.log 

Moduledir %ROOT%\modules

CacheDir %ROOT%\data

Pidfile %ROOT%\data\nxlog.pid

SpoolDir %ROOT%\data

#LogFile %ROOT%\data\nxlog.log

LogFile %LOGFILE%

<Extension json>

    Module xm_json

</Extension>

<Extension syslog>

    Module xm_syslog

</Extension>

<Extension File operations>

    Module xm_fileop 

</Extension>

#####################################################

############    Windows Core Event Logs   ###########

#################       START      ##################

#################      0 tasks     ##################

#####################################################

<Input lgs_eventlog>

    Module im_msvistalog

    # Prevent endless loop due to 5156 logging nxlog.exe connections

    Exec if ($SourceName == 'Microsoft-Windows-Security-Auditing' and $EventID IN (5156, 5157) and $Application =~ /\\nxlog\.exe$/i) drop();

    # Define Queries

    Query       <QueryList>\

                        <Query Id="0">\

                            <Select Path="Application">*</Select>\

                            <Select Path="System">*</Select>\

                            <Select Path="Security">*</Select>\

                            <Select Path="Setup">*</Select>\

                            <Select Path="Microsoft-Windows-AppLocker/EXE and DLL">*</Select>\

                            <Select Path="Microsoft-Windows-AppLocker/MSI and Script">*</Select>\

                            <Select Path="Microsoft-Windows-AppLocker/Packaged app-Deployment">*</Select>\

                            <Select Path="Microsoft-Windows-AppLocker/Packaged app-Execution">*</Select>\

                            <Select Path="Microsoft-Windows-LSA/Operational">*</Select>\

                            <Select Path="Microsoft-Windows-NTLM/Operational">*</Select>\

                            <Select Path="Microsoft-Windows-PowerShell/Admin">*</Select> \

                            <Select Path="Microsoft-Windows-Powershell/Operational">*</Select> \

                            <Select Path="Microsoft-Windows-PrintService/Admin">*</Select> \

                            <Select Path="Microsoft-Windows-PrintService/Operational">*</Select> \

                            <Select Path="Microsoft-Windows-TaskScheduler/Operational">*</Select> \

                            <Select Path="Microsoft-Windows-TerminalServices-LocalSessionManager/Operational">*</Select> \

                            <Select Path="Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational">*</Select> \

                            <Select Path="Windows PowerShell">*</Select> \

                            <Suppress Path="Security">*[System[(EventID=4689 or EventID=5158 or EventID=5440 or EventID=5444)]]</Suppress> \

                            <Suppress Path="Windows PowerShell">*[System[(EventID=501 or EventID=400 or EventID=600)]]</Suppress> \

                        </Query>\

                    </QueryList> 

    # Filter out by Application

    Exec if ($Application =~ /nxlog\\nxlog.exe/) drop();

    # Filter out by Source and Destination IP   

    Exec if ($SourceAddress =~ /224.0.0.252/) drop();

    Exec if ($SourceAddress =~ /192.168.1.255/) drop();

    Exec if ($SourceAddress =~ /224.0.0.1/) drop();

    Exec if ($SourceAddress =~ /239.255.255.250/) drop();

    Exec if ($DestAddress =~ /224.0.0.22/) drop();

    # Filter out by Command Line    

    Exec if ($CommandLine =~ /"C:\\Program Files \(x86\)\\nxlog\\nxlog.exe" -c "C:\\Program Files \(x86\)\\nxlog\\conf\\nxlog.conf"/) drop();

    # Dropping non-security but often-loud logs for DFS and failed ISATAP issues

    Exec if ($EventID == 4202 or $EventID == 4208 or $EventID == 4302 or $EventID == 4304 or $EventID == 5004) drop();\

    # Workaround for local time so as to standardize to absolute microseconds since epoch

    # Filtering \r\n\t characters and commas from 4656 logs.

    Exec if ($EventID == 33205 ) drop();

    Exec if ($EventID == 4656 or $EventID == 4663 or $EventID == 5140 or $EventID == 5145 ) $AccessList = replace($AccessList, "\r\n\t\t\t\t", ","); 

    Exec if ($EventID == 4656 or $EventID == 4663 or $EventID == 5140 or $EventID == 5145 ) $AccessList = replace($AccessList, "%%", "");

    Exec $EventTime = integer($EventTime);

    # JSON is required because some Windows logs contain new-line characters.

    <Exec>  

        $Message = replace($Message, "\t", " "); 

$Message = replace \

        ($Message, "\n", " "); $Message = replace($Message, "\r", " "); 

        $Message = to_json();      

        $raw_event = $Message;

        to_syslog_bsd();

    </Exec>

</Input>

<Output lgs_out_eventlog>

    Module om_ssl

    Host %SIEM%

    Port %PORT%

    AllowUntrusted TRUE

    CAFile %CERTDIR%\ca.pem

    CertFile %CERTDIR%\client.pem

    CertKeyFile %CERTDIR%\client.key

    Exec  $SyslogFacility = 'LOCAL0'; to_syslog_bsd();

</Output>

<Route route_eventlog>

    Path lgs_eventlog => lgs_out_eventlog

</Route>

#####################################################

############    Windows Core Event Logs   ###########

#################         END      ##################

#####################################################

#####################################################

#################  SYSMON Event Logs ################

#################       START      ##################

#################      2 tasks     ##################

#####################################################

#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

# Tasks:

# 1) Install Sysmon on your endpoints if you intend to use this feature

#

# https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon

#

#

# 2) If you want to utilize Sysmon Logging 

# remove all # at the beginning of lines from 

# <Input lgs_eventlog_sysmon> to </Route> after route_eventlog_sysmon in this section

#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

#

<Input lgs_eventlog_sysmon>

    Module im_msvistalog

    Query       <QueryList>\

                        <Query Id="0">\

                            <Select Path="Microsoft-Windows-Sysmon/Operational">*</Select>\

                        </Query>\

                    </QueryList> 

    # Workaround for local time so as to standardize to absolute microseconds since epoch

    Exec $EventTime = integer($EventTime);

    # JSON is required because some Windows logs contain new-line characters.

    <Exec>

        $Message = replace($Message, "\t", " "); $Message = replace \

        ($Message, "\n", " "); $Message = replace($Message, "\r", " "); 

        $Message = to_json();      

        $raw_event = $Message;

        to_syslog_bsd();

    </Exec>

</Input>

<Output lgs_out_eventlog_sysmon>

    Module om_ssl

    Host %SIEM%

    Port %PORT%

    AllowUntrusted TRUE

    CAFile %CERTDIR%\ca.pem

    CertFile %CERTDIR%\client.pem

    CertKeyFile %CERTDIR%\client.key

    Exec  $SyslogFacility = 'LOCAL0'; to_syslog_bsd();

</Output>

<Route route_eventlog_sysmon>

    Path lgs_eventlog_sysmon => lgs_out_eventlog_sysmon

</Route>

#####################################################

#################  SYSMON Event Logs ################

#################        END       ##################

#####################################################

#####################################################

Full nxlog.conf Content:

Please change 10.10.10.10 for Logsign IP address.

This one is for Windows Core Events and general usage for NXLog with Logsign. Remove the sections that you won't use to avoid errors.

# Please set SIEM to the IP address of your Logsign SIEM

define SIEM 10.10.10.10

define PORT 6514

# Please set ROOT to the folder your nxlog was installed into

#define ROOT C:\Program Files\nxlog

#define ROOT_STRING C:\Program Files\nxlog

define ROOT C:\Program Files\nxlog

define ROOT_STRING C:\Program Files\nxlog

# Define certs if used during Sensor Logger creation

define CERTDIR %ROOT%\cert

define CONFDIR  %ROOT%\conf

# Define internal log details for NXLog

define LOGDIR   %ROOT%\data

define LOGFILE  %LOGDIR%\nxlog.log 

Moduledir %ROOT%\modules

CacheDir %ROOT%\data

Pidfile %ROOT%\data\nxlog.pid

SpoolDir %ROOT%\data

#LogFile %ROOT%\data\nxlog.log

LogFile %LOGFILE%

<Extension json>

    Module xm_json

</Extension>

<Extension syslog>

    Module xm_syslog

</Extension>

<Extension File operations>

    Module xm_fileop 

</Extension>

#####################################################

############    Windows Core Event Logs   ###########

#################       START      ##################

#################      0 tasks     ##################

#####################################################

<Input lgs_eventlog>

    Module im_msvistalog

    # Prevent endless loop due to 5156 logging nxlog.exe connections

    Exec if ($SourceName == 'Microsoft-Windows-Security-Auditing' and $EventID IN (5156, 5157) and $Application =~ /\\nxlog\.exe$/i) drop();

    # Define Queries

    Query       <QueryList>\

                        <Query Id="0">\

                            <Select Path="Application">*</Select>\

                            <Select Path="System">*</Select>\

                            <Select Path="Security">*</Select>\

                            <Select Path="Setup">*</Select>\

                            <Select Path="Microsoft-Windows-AppLocker/EXE and DLL">*</Select>\

                            <Select Path="Microsoft-Windows-AppLocker/MSI and Script">*</Select>\

                            <Select Path="Microsoft-Windows-AppLocker/Packaged app-Deployment">*</Select>\

                            <Select Path="Microsoft-Windows-AppLocker/Packaged app-Execution">*</Select>\

                            <Select Path="Microsoft-Windows-LSA/Operational">*</Select>\

                            <Select Path="Microsoft-Windows-NTLM/Operational">*</Select>\

                            <Select Path="Microsoft-Windows-PowerShell/Admin">*</Select> \

                            <Select Path="Microsoft-Windows-Powershell/Operational">*</Select> \

                            <Select Path="Microsoft-Windows-PrintService/Admin">*</Select> \

                            <Select Path="Microsoft-Windows-PrintService/Operational">*</Select> \

                            <Select Path="Microsoft-Windows-TaskScheduler/Operational">*</Select> \

                            <Select Path="Microsoft-Windows-TerminalServices-LocalSessionManager/Operational">*</Select> \

                            <Select Path="Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational">*</Select> \

                            <Select Path="Windows PowerShell">*</Select> \

                            <Suppress Path="Security">*[System[(EventID=4689 or EventID=5158 or EventID=5440 or EventID=5444)]]</Suppress> \

                            <Suppress Path="Windows PowerShell">*[System[(EventID=501 or EventID=400 or EventID=600)]]</Suppress> \

                        </Query>\

                    </QueryList> 

    # Filter out by Application

    Exec if ($Application =~ /nxlog\\nxlog.exe/) drop();

    # Filter out by Source and Destination IP   

    Exec if ($SourceAddress =~ /224.0.0.252/) drop();

    Exec if ($SourceAddress =~ /192.168.1.255/) drop();

    Exec if ($SourceAddress =~ /224.0.0.1/) drop();

    Exec if ($SourceAddress =~ /239.255.255.250/) drop();

    Exec if ($DestAddress =~ /224.0.0.22/) drop();

    # Filter out by Command Line    

    Exec if ($CommandLine =~ /"C:\\Program Files \(x86\)\\nxlog\\nxlog.exe" -c "C:\\Program Files \(x86\)\\nxlog\\conf\\nxlog.conf"/) drop();

    # Dropping non-security but often-loud logs for DFS and failed ISATAP issues

    Exec if ($EventID == 4202 or $EventID == 4208 or $EventID == 4302 or $EventID == 4304 or $EventID == 5004) drop();\

    # Workaround for local time so as to standardize to absolute microseconds since epoch

    # Filtering \r\n\t characters and commas from 4656 logs.

    Exec if ($EventID == 33205 ) drop();

    Exec if ($EventID == 4656 or $EventID == 4663 or $EventID == 5140 or $EventID == 5145 ) $AccessList = replace($AccessList, "\r\n\t\t\t\t", ","); 

    Exec if ($EventID == 4656 or $EventID == 4663 or $EventID == 5140 or $EventID == 5145 ) $AccessList = replace($AccessList, "%%", "");

    Exec $EventTime = integer($EventTime);

    # JSON is required because some Windows logs contain new-line characters.

    <Exec>  

        $Message = replace($Message, "\t", " "); 

$Message = replace \

        ($Message, "\n", " "); $Message = replace($Message, "\r", " "); 

        $Message = to_json();      

        $raw_event = $Message;

        to_syslog_bsd();

    </Exec>

</Input>

<Output lgs_out_eventlog>

    Module om_ssl

    Host %SIEM%

    Port %PORT%

    AllowUntrusted TRUE

    CAFile %CERTDIR%\ca.pem

    CertFile %CERTDIR%\client.pem

    CertKeyFile %CERTDIR%\client.key

    Exec  $SyslogFacility = 'LOCAL0'; to_syslog_bsd();

</Output>

<Route route_eventlog>

    Path lgs_eventlog => lgs_out_eventlog

</Route>

#####################################################

############    Windows Core Event Logs   ###########

#################         END      ##################

#####################################################

#####################################################

#################  SYSMON Event Logs ################

#################       START      ##################

#################      2 tasks     ##################

#####################################################

#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

# Tasks:

# 1) Install Sysmon on your endpoints if you intend to use this feature

#

# https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon

#

#

# 2) If you want to utilize Sysmon Logging 

# remove all # at the beginning of lines from 

# <Input lgs_eventlog_sysmon> to </Route> after route_eventlog_sysmon in this section

#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

#

<Input lgs_eventlog_sysmon>

    Module im_msvistalog

    Query       <QueryList>\

                        <Query Id="0">\

                            <Select Path="Microsoft-Windows-Sysmon/Operational">*</Select>\

                        </Query>\

                    </QueryList> 

    # Workaround for local time so as to standardize to absolute microseconds since epoch

    Exec $EventTime = integer($EventTime);

    # JSON is required because some Windows logs contain new-line characters.

    <Exec>

        $Message = replace($Message, "\t", " "); $Message = replace \

        ($Message, "\n", " "); $Message = replace($Message, "\r", " "); 

        $Message = to_json();      

        $raw_event = $Message;

        to_syslog_bsd();

    </Exec>

</Input>

<Output lgs_out_eventlog_sysmon>

    Module om_ssl

    Host %SIEM%

    Port %PORT%

    AllowUntrusted TRUE

    CAFile %CERTDIR%\ca.pem

    CertFile %CERTDIR%\client.pem

    CertKeyFile %CERTDIR%\client.key

    Exec  $SyslogFacility = 'LOCAL0'; to_syslog_bsd();

</Output>

<Route route_eventlog_sysmon>

    Path lgs_eventlog_sysmon => lgs_out_eventlog_sysmon

</Route>

#####################################################

#################  SYSMON Event Logs ################

#################        END       ##################

#####################################################

#####################################################

#################  DHCP Event Logs ##################

#################      START       ##################

#####################################################

# This section will be used for forwarding DHCP logs

<Input dhcp_input>

    Module      im_file

# The following line should be edited for the path where the DHCP logs are kept.          

    File        "C:\\Windows\\System32\\dhcp\\DhcpSrvLog-*.log"  

    Exec        $Message=$raw_event; $SyslogFacility = 'LOCAL1';

</Input>

<Output dhcp_out>

   Module      om_ssl

   Host %SIEM%

   Port %PORT%

   AllowUntrusted TRUE

   CAFile %CERTDIR%\ca.pem

   CertFile %CERTDIR%\client.pem

   CertKeyFile %CERTDIR%\client.key

   Exec        to_syslog_bsd();

</Output>

<Route dhcp_site1>

    Path        dhcp_input => dhcp_out

</Route>

#####################################################

#################  DHCP Event Logs ##################

#################        END       ##################

#####################################################

#####################################################

#################  IIS Event Logs  ##################

#################      START       ##################

#####################################################

# This section will be used for forward IIS logs

# Parcel rule definition for IIS logs. The fields content should be updated according to the columns opened in the IIS file.

<Extension w3c>

    Module xm_csv

    Fields $date, $time, $s_ip, $cs_method, $cs_uri_stem, $cs_uri_query, $s_port, $cs_username, $c_ip, $cs_User_Agent, $cs_Referer, $sc_status, $sc_substatus, $sc_win32_status, $time_taken, $X-Forwarded-For

    FieldTypes string, string, string, string, string, string, integer, string, string, string, string, integer, integer, integer, integer, string

    Delimiter ' '

</Extension>

# Lines starting with hash are not imported in IIS files

<Input IIS_Site1>

    Module    im_file

# The following line must be edited for the IIS file path

    File    "C:\\inetpub\\logs\\LogFiles\\\\u_ex*"

    SavePos  TRUE

    Exec if $raw_event =~ /^#/ drop();              \

       else                           \

       {                            \

            w3c->parse_csv();                    \

            $EventTime = parsedate($date + " " + $time);  \

            $SourceName = "IIS";              \

            $raw_event = to_json();             \

       }

</Input>

<Output IIS_Site1_out>

   Module      om_ssl

   Host %SIEM%

   Port %PORT%

   AllowUntrusted TRUE

   CAFile %CERTDIR%\ca.pem

   CertFile %CERTDIR%\client.pem

   CertKeyFile %CERTDIR%\client.key

   Exec        $SyslogFacility = 'LOCAL2'; $Message = to_json(); to_syslog_bsd();

</Output>

<Route IIS_Site1>

    Path        IIS_Site1 => IIS_Site1_out

</Route>

#####################################################

#################  IIS Event Logs  ##################

#################      END         ##################

#####################################################

#####################################################

#################  Exchange Event Logs  #############

#################      START       ##################

#####################################################

# This section will be used for forwarding Exchange Message Tracking logs

# Parcel rule definition for Message Tracking logs. The content of fields should be updated according to the columns opened in the Message Tracking file. The definition below is the definition for Exchange 2016

<Extension exchange>

    Module      xm_csv

                  Fields $date-time,$client-ip,$client-hostname,$server-ip,$server-hostname,$source-context,$connector-id,$source,$event-id,$internal-message-id,$message-id,$network-message-id,$recipient-address,$recipient-status,$total-bytes,$recipient-count,$related-recipient-address,$reference,$message-subject,$sender-address,$return-path,$message-info,$directionality,$tenant-id,$original-client-ip,$original-server-ip,$custom-data,$transport-traffic-type,$log-id,$schema-version

    Delimiter   ,

</Extension>

# Lines starting with a hash are dropped

<Input Exchange_Site1>

    Module      im_file

# The following path definition should be arranged for Message Tracking log files

    File        'D:\\TransportRoles\\Logs\MessageTracking\\MSGTRK*'

                  Exec if $raw_event =~ /^#/ drop();              \

       else                           \

       {                            \

            exchange->parse_csv();                    \

            $EventTime = parsedate($date + " " + $time);  \

            $SourceName = "EXCHANGE";              \

            $raw_event = to_json();             \

       }

</Input>

<Output Exchange_Site1_out>

   Module      om_ssl

   Host %SIEM%

   Port %PORT%

   AllowUntrusted TRUE

   CAFile %CERTDIR%\ca.pem

   CertFile %CERTDIR%\client.pem

   CertKeyFile %CERTDIR%\client.key

   Exec        $SyslogFacility = 'LOCAL3'; $Message = to_json(); to_syslog_bsd();

</Output>

<Route Exchange_Site1>

    Path        Exchange_Site1 => Exchange_Site1_out

</Route>

#####################################################

#################  Exchange Event Logs  #############

#################      END         ##################

#####################################################

#####################################################

#################  DNS Event Logs  #################

#################      START         ################

#####################################################

# This section will be used for routing DNS logs

define EMPTY_EVENT_REGEX /(^$|^\s+$)/

define NOT_STARTING_WITH_DATE_REGEX /^(?!\d+\/\d+\/\d+).+/

<Input dns>

    Module      im_file

# Edit the following line for the DNS file path

    File        "C:\\Windows\\System32\\dns\\dns.log"  

                  SavePos TRUE

    ReadFromLast TRUE

    PollInterval 1

                  <Exec>

        # empty lines are dropped

        if $raw_event =~ %EMPTY_EVENT_REGEX% drop();

        # date ile baslamayan satirlar droplanir

        if $raw_event =~ %NOT_STARTING_WITH_DATE_REGEX% drop();

    </Exec>

</Input>

<Output out_dns>

  Module om_ssl

    Host %SIEM%

    Port %PORT%

    AllowUntrusted TRUE

    CAFile %CERTDIR%\ca.pem

    CertFile %CERTDIR%\client.pem

    CertKeyFile %CERTDIR%\client.key

  Exec $SyslogFacility = 'LOCAL4'; to_syslog_bsd();

</Output>

<Route dns>

    Path        dns => out_dns

</Route>

#####################################################

#################  DNS Event Logs  #################

#################      END         ##################

#####################################################

#####################################################

#################  FTP Event Logs  #################

#################      START         ################

#####################################################

<Input ftp>

    Module    im_file

    File    "C:\Program Files (x86)\FileZilla Server\Logs\fzs*"

    SavePos  TRUE

    Exec if $raw_event =~ /^#/ drop();              \

       else                           \

       {                            \

            w3c->parse_csv();                    \

            $EventTime = parsedate($date + " " + $time);  \

            $SourceName = "powershell";              \

            $raw_event = to_json();             \

       }

</Input>

<Output ftp_out>

   Module om_ssl

    Host %SIEM%

    Port %PORT%

    AllowUntrusted TRUE

    CAFile %CERTDIR%\ca.pem

    CertFile %CERTDIR%\client.pem

    CertKeyFile %CERTDIR%\client.key

   #Please note that if you do not see the IIS logs in Log Search, you will need to uncomment the line below.  

   #The Generic Syslog event source requires that the logs have a syslog header, as specified by RFC3164.  This will add the required RFC3164 syslog header to the logs.

  #Exec         to_syslog_bsd();

</Output>

<Route ftp>

    Path        ftp => ftp_out

</Route>

#####################################################

#################  FTP Event Logs  #################

#################      END           ################

#####################################################

#####################################################

#################  WAMP Event Logs  #################

#################      START         ################

#####################################################

<Input wamp>

    Module    im_file

    File    "C:\\wamp64\\logs\\*log*"

    SavePos  TRUE

    Exec if $raw_event =~ /^#/ drop();              \

       else                           \

       {                            \

            w3c->parse_csv();                    \

            $EventTime = parsedate($date + " " + $time);  \

            $SourceName = "wamp";              \

            $raw_event = to_json();             \

       }

</Input>

<Output wamp_out>

   Module      om_ssl

    Host %SIEM%

    Port %PORT%

    AllowUntrusted TRUE

    CAFile %CERTDIR%\ca.pem

    CertFile %CERTDIR%\client.pem

    CertKeyFile %CERTDIR%\client.key

   #Please note that if you do not see the IIS logs in Log Search, you will need to uncomment the line below.  

   #The Generic Syslog event source requires that the logs have a syslog header, as specified by RFC3164.  This will add the required RFC3164 syslog header to the logs.

  #Exec         to_syslog_bsd();

</Output>

<Route wamp>

    Path        wamp => wamp_out

</Route>

#####################################################

#################  WAMP Event Logs  #################

#################      END           ################

#####################################################

#####################################################

#################  TOMCAT Event Logs  ###############

#################      START         ################

#####################################################

<Input tomcat>

    Module    im_file

    File    "C:\\apachetomcat8\\logs\\*access*"

    SavePos  TRUE

    Exec if $raw_event =~ /^#/ drop();              \

       else                           \

       {                            \

            w3c->parse_csv();                    \

            $EventTime = parsedate($date + " " + $time);  \

            $SourceName = "tomcat";              \

            $raw_event = to_json();             \

       }

</Input>

<Output tomcat_out>

   Module      om_ssl

    Host %SIEM%

    Port %PORT%

    AllowUntrusted TRUE

    CAFile %CERTDIR%\ca.pem

    CertFile %CERTDIR%\client.pem

    CertKeyFile %CERTDIR%\client.key

   #Please note that if you do not see the IIS logs in Log Search, you will need to uncomment the line below.  

   #The Generic Syslog event source requires that the logs have a syslog header, as specified by RFC3164.  This will add the required RFC3164 syslog header to the logs.

  #Exec         to_syslog_bsd();

</Output>

<Route tomcat>

    Path        tomcat => tomcat_out

</Route>

#####################################################

#################  TOMCAT Event Logs  ###############

#################      END           ################

#####################################################

#####################################################

#############      MSSQL Logs   #####################

#############        START      #####################

#####################################################

<Input MSSQL_IN>

Module      im_msvistalog

SavePos      FALSE

ReadFromLast              TRUE

Query         <QueryList> \

<Query Id="0">  \

<Select Path="Application">*[System[(EventID='33205')]]</Select>\

</Query>  \

</QueryList>

Exec           $Message = $raw_event;

Exec           if $raw_event =~ /^#/ drop();\

Else\

{\

$SourceName = "MSSQL-NXLOG";\

}

Exec           if $raw_event =~ /action_id:(\S+)/ $Action_ID = $1;

Exec           if $raw_event =~ /database_name:(\S+)/ $DataBase = $1;

Exec           if $raw_event =~ /server_instance_name:(\S+)/ $SV_Instace = $1;

Exec           if $raw_event =~ /session_server_principal_name:(\S+)/ $User = $1;

Exec           if $raw_event =~ /AUDIT_SUCCESS/\

{\

$Result = 'Success';\

}\

else\

$Result = 'Failure';

Exec            $Message = replace($Message, "\t", " "); $Message = replace($Message, "\n", " "); $Message = replace($Message, "\r", " ");

Exec $Message = to_json();

</Input>

<Output MSSQL_OUT>

Module      om_ssl

Host           %SIEM%

Port            %PORT%

AllowUntrusted TRUE

CAFile %CERTDIR%\ca.pem

CertFile %CERTDIR%\client.pem

CertKeyFile %CERTDIR%\client.key

Exec           $SyslogFacility = 'LOCAL5'; to_syslog_bsd();

</Output>

<Route mssql>

Path           MSSQL_IN => MSSQL_OUT

</Route>

#####################################################

################  MSSQL Logs    #####################

################       END      #####################

#####################################################