IBM Security QRadar

 View Only

  • 1.  Windows Security Event Logs via Event Hub

    Posted Fri March 01, 2024 07:21 AM

    I was wondering if anyone could help please. I have a number of Windows VMs in Azure that are sending Windows Security Event Logs to an Event Hub. I have setup a log source in QRadar following an IBM tech doc: https://www.ibm.com/support/pages/qradar-how-collect-windows-events-microsoft%C2%AE-azure-event-hub-quick-start-guide and it is not working quite as described in the tech doc. However, the biggest problem I am having is that the events from the VMs in Azure are in JSON, and the DSM for the Windows Security Event logs does not parse them. Am I missing something? Is it possible to ingest Windows events from Azure VMs into QRadar? Any help/advice would be greatly appreciated.



    ------------------------------
    Viorel Chicu
    ------------------------------


  • 2.  RE: Windows Security Event Logs via Event Hub

    Posted Mon March 11, 2024 04:40 AM

    Hi Viorel,

    The Microsoft Windows Security Event Log DSM (DSM-MicrosoftWindows) should be able to parse the events just fine even if they are JSON. Please check this page for examples: https://www.ibm.com/docs/en/dsm?topic=mwsel-microsoft-windows-security-event-log-sample-event-messages Do your event match the sample event formatting?

    If you open your events in your own DSM Editor, do they say Parsed NOT mapped, or simply not parsed?

    Also, if you have a Log Source Extension (LSX) for this DSM enabled, it might be overriding the default parsing of JSON events - try disabling any overrides to rule this out.

    Else, if your events are parsed but not mapped - or if you're stuck - you can just open a support case including Getlogs from the Console and the eventcollector for these events, an event export in Full details/XML and screen captures of the entire log source configuration, and support will investigate.

    Best regards,



    ------------------------------
    Carl Mohn
    IBM
    Dublin
    ------------------------------

    Original Message


  • 3.  RE: Windows Security Event Logs via Event Hub

    Posted Tue March 12, 2024 07:24 AM

    Hi Carl,

    Thank you for your reply. The events when opened in the DSM editor say "Not Parsed". There are no extensions enabled for this log source. I checked the link that you posted and our event format is different from the examples in there. They are like this: {"Computer":"computername","EventCategory":13312,"EventData":"<DataItem Type=\"System.XmlData\" time=\"2024-02-22T09:10:59.3686279Z\" sourceHealthServiceId=\"9204c8ca-0e0f-4266-8f7a-acccab645eaf\"><EventData xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\

    I do have a case open with IBM support, but progress has been extremely slow. Perhaps the issue is related to what Stefano Pasa is describing in his reply, the events have to be collected with the Diagnostic Extension and not AMA or Log Analytics. I will ask the Azure team to confirm how the events are collected. 



    ------------------------------
    Viorel Chicu
    ------------------------------

    Original Message


  • 4.  RE: Windows Security Event Logs via Event Hub

    Posted Tue March 12, 2024 04:23 AM

    Hi Viorel

    The key is what you use to collect events from VMs. The only way to have events parsed is to collect them with Diagnostic Extension, from what I saw. AMA  or Log Analytics agent are not working with default parser



    ------------------------------
    Stefano Pasa
    ------------------------------

    Original Message


  • 5.  RE: Windows Security Event Logs via Event Hub

    Posted Tue March 12, 2024 07:27 AM

    Hi Stefano, thank you for your reply. I will check with our Azure team to see how the events are collected. Currently the payload (beginning of payload) looks like this: {"Computer":"computername","EventCategory":13312,"EventData":"<DataItem Type=\"System.XmlData\" time=\"2024-02-22T09:10:59.3686279Z\" sourceHealthServiceId=\"9204c8ca-0e0f-4266-8f7a-acccab645eaf\"><EventData xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\



    ------------------------------
    Viorel Chicu
    ------------------------------

    Original Message