Cribl Windows Event Logs Integration via Syslog

Purpose

This guide explains how to collect Windows Event Logs in Logsign USO using Cribl Stream as the forwarding agent, as an alternative to NXLog. Cribl reads Windows Event Forwarding (WEF) data, flattens it to JSON, and ships it to Logsign over syslog. Logsign parses that JSON with a dedicated Cribl Windows Event Logs plugin (PrefixID 4511) that normalizes Security, System, WinRM, and PowerShell channel events.

Use this method if you already run Cribl Stream in your environment and would rather not deploy NXLog on your Windows hosts. If you have no existing Cribl deployment, NXLog remains the simpler path: see NXLog Configuration.

Prerequisites

• A working Cribl Stream deployment with a source that already receives Windows Event Forwarding (WEF) data from your Windows hosts.
• Network connectivity from Cribl Stream to Logsign USO over syslog (the same port/protocol your other syslog sources use).

Step 1: Configure the Cribl Pipeline

The exact pipeline steps below reflect what the Logsign parser expects on the wire, not a screen-by-screen walkthrough of the Cribl Stream UI. Confirm the current UI paths in your own Cribl Stream version before handing this to a customer.

1. In Cribl Stream, build a pipeline that takes the WEF source and flattens each Windows Event into a single JSON object per line, rather than nested XML. Field names should match the raw Windows Event Log schema (for example SystemTime, EventRecordID, Computer, SubjectUserName, TargetUserName). The Logsign plugin maps directly off those key names.
2. Route the pipeline's output to a Destination that sends syslog to Logsign USO, one flattened JSON event per syslog message.

Step 2: Add the Data Source in Logsign USO

1. Add a new syslog source in Logsign USO for the host(s) forwarding through Cribl.
2. Set the device/plugin type to Cribl Windows Event Logs.

What Gets Collected

The plugin normalizes the same categories of information NXLog-forwarded Windows Event Logs provide: event ID, record ID, source/target user and domain, logon type, process ID/name, source host and IP (with city/country geo enrichment), and severity. It recognizes the Security, System, WinRM, and PowerShell event channels and maps their fields into Logsign's standard Event/Source/Destination/Process schema.

Notes and Limits

• The plugin expects SystemTime as an ISO-8601 UTC timestamp with fractional seconds (for example 2026-08-01T12:00:00.1234567Z) and tolerates both 7- and 9-digit fractional-second precision. If your Cribl pipeline emits a different timestamp format, events will fail to parse correctly.
• Both ProcessID and ProcessId key casings are accepted, since different Windows Event channels use different casing for the same field.
• Truncated or malformed JSON payloads are dropped rather than raising an error, so a misconfigured Cribl pipeline will show as silently missing events rather than a visible failure. Check the Cribl pipeline output format first if expected events are not arriving.