The only LEEF formatted log file that we are collecting are our Zscaler logs and these are parsing correctly.
For Windows logs we are using a combination of the WInCollect agent on Domain Controllers (high volume log generation) and Windows Event Collection (WEC).
I highly recommend the WEC method of event collection. Google "jessica payne windows event forwarding". There used to be a series of videos on this but they don't appear to existing anymore but you will still get a good start with that Google and then I would branch out from there.
I currently have two Windows Event Collectors configured for our Client computers (desktops and laptops) to send their logs to and one Event Collector for our servers (except for the Domain controllers) to send their logs to.
NOTE: The computers are not sending all their logs, they are sending specific Event ID's from specific logs (Security, Application, System, Sysmn, PowerShell, etc., etc., etc.) to the Event Collectors and then onto QRadar via a WinCollect agent installed on the Event Collectors that then forward the logs.
This is pretty easy to configure using some Group Policies and some subscription definitions (subscription definitions guidelines are available on Microsoft and from the NSA via GitHub). I would also suggest looking at the SwiftonSecurity Sysmon template as a starting point for filtering Sysmon logging.
You might also want to look at the
https://www.ultimatewindowssecurity.com/ website for past webinars on WEC. They also product a software for managing Windows Event Collection infrastructures.
I don't know how large your environment is but IMHO having an agent on every system is probably not the best way to do log collection. When deployed properly the WEC solution works very well.
HTH,
Robert
------------------------------
Robert Strom
------------------------------
Original Message:
Sent: Sat November 23, 2019 03:02 AM
From: Siddhant Mishra
Subject: Windows Event Logs Forwarded via Nxlog in LEEF Format
Hello Robert,
Thanks for your revert. Really appreciate it.
Actually, the same problem is encountered for all the Windows 10 log events that are forwarded and not a specific log event that was shared. Could you please let me know your suggestions on how to overcome this challenge?
Thanks,
------------------------------
Siddhant Mishra
Original Message:
Sent: Fri November 22, 2019 10:02 AM
From: Robert Strom
Subject: Windows Event Logs Forwarded via Nxlog in LEEF Format
Hello,
While my answer cannot be considered definitive I believe that issue that you're experiencing has to do with the fact that QRadar doesn't recognize that particular log ( Microsoft-Windows-Security-Mitigations) and that particular event. I am not sending any log messages via Universal LEEF but I do have some other events that behave like this / are not getting parsed.
Here is an example of a log message that is getting sent to QRadar via WinCollect and it still does not get parsed. QRadar just does not understand the messages. Apparently the developers have not gone down the list of the Applications and Services Logs and devoted any time in parsing them (it does parse most of the Sysmon messages - not V10 yet though). This log message is seen as an unknown Event Name, Unknown Low Level Category, and Unknown Event Description.
If other log messages are getting sent via Universal LEFF and getting parsed then I believe that you're probably experiencing what I am describing. If all of your Universal LEEF log messages are not getting parsed then there is a larger problem.
HTH,
Robert Strom
------------------------------
Robert Strom
Original Message:
Sent: Thu November 21, 2019 03:32 AM
From: Siddhant Mishra
Subject: Windows Event Logs Forwarded via Nxlog in LEEF Format
Hello team,
This is my first experience in using Qradar platform.
I have been doing a POC for a while now and seem to be stuck with the scenario where logs received in Qradar do not seem to parsed. Here are some details below which you might find helpful:
I would really appreciate it if someone can help me resolve this challenge as its been quite a while now since I have been struggling with this issue.
Objective: Forward Windows Event Logs in LEEF via Nxlog EE to Qradar CE 7.3.1
Screenshot of "Log Activity" Console Attached
------------------------------
Siddhant Mishra
------------------------------