Ingesting Windows logs into Chronicle

[Chris_B]

Anyone have a good experience ingesting Windows logs into Chronicle?
I’ve heard nxlogs , cribl, etc.
E.g. can Chronicle use cribl stream ? I see there’s “edge” and “stream” flavors of cribl?

[Tomtomfridman]

This comment was originally sent by Tom Fridman
Hi @Chris_B
Not sure if you are talking about SIEM or SOAR.
Either way, Both solutions require a middleware to collect all the windows logs. The ability to connect to all windows machines in an environment and individually pull logs from all of them is unfortunately not possible on both SOAR and SIEM.

SOAR is designed to pull alerts, not raw logs. Windows logs are usually forwarded to a SIEM (Middleware) that correlates the logs and generates correlation alerts. These alerts are then forwarded to SOAR.

On the SIEM side (Specifically Chronicle) it is possible to use NXLog as the middleware that collects all the windows logs and forward them to SIEM. It is documented here https://cloud.google.com/chronicle/docs/ingestion/default-parsers/collect-windows-events

[mccrilb]

We use event collectors and NXLog.

[mccrilb]

We only ingest Domain Controller logs. our endpoint information is from Crowdstrike.

[Pieter_Van]

We use windows event forwarding in combination with nxlog. That goes to logstash, where we split traffic (IIS,winevent,sysmon,sql) from that stream to different chronicle forwarders. It was quite the setup , but allows for fine-grained routing options

[Tonio]

Hello,

I am reopening this because I have some Windows servers (AD, DNS, DHCP) that needs to send logs to Chronicle Forwarder on-prem (docker on windows VM), and NXLog is not an option for us. 

We tried following this guide to setup subscriptions from the servers and a collector in the VM with the Forwarder, but still throubleshooting it.

More importanty, looking ahead, I miss to understand how to route the logs from the collector VM to the  Forworder itslef (and then to Chronicle SIEM).

Can anyone share any thoughts/solution on this? 

Many thanks

[nghtf]

Just curious why nxlog is not an option?

[Tonio]

That's just the customer request. I am kind of understanding that's the best way to go by a long shot, so I will try to push it.

Still, it would be good to know if there is a different way, as a general knowledge.

thanks

A