Ingesting Windows logs into Chronicle

This comment was originally sent by Tom Fridman
Hi @Chris_B
Not sure if you are talking about SIEM or SOAR.
Either way, Both solutions require a middleware to collect all the windows logs. The ability to connect to all windows machines in an environment and individually pull logs from all of them is unfortunately not possible on both SOAR and SIEM.

SOAR is designed to pull alerts, not raw logs. Windows logs are usually forwarded to a SIEM (Middleware) that correlates the logs and generates correlation alerts. These alerts are then forwarded to SOAR.

On the SIEM side (Specifically Chronicle) it is possible to use NXLog as the middleware that collects all the windows logs and forward them to SIEM. It is documented here https://cloud.google.com/chronicle/docs/ingestion/default-parsers/collect-windows-events

We use event collectors and NXLog.

We only ingest Domain Controller logs. our endpoint information is from Crowdstrike.

We use windows event forwarding in combination with nxlog. That goes to logstash, where we split traffic (IIS,winevent,sysmon,sql) from that stream to different chronicle forwarders. It was quite the setup , but allows for fine-grained routing options

Hello,

I am reopening this because I have some Windows servers (AD, DNS, DHCP) that needs to send logs to Chronicle Forwarder on-prem (docker on windows VM), and NXLog is not an option for us. 

We tried following this guide to setup subscriptions from the servers and a collector in the VM with the Forwarder, but still throubleshooting it.

More importanty, looking ahead, I miss to understand how to route the logs from the collector VM to the  Forworder itslef (and then to Chronicle SIEM).

Can anyone share any thoughts/solution on this? 

Many thanks

Just curious why nxlog is not an option?

That's just the customer request. I am kind of understanding that's the best way to go by a long shot, so I will try to push it.

Still, it would be good to know if there is a different way, as a general knowledge.

thanks

A