Log type for Windows logs : WINEVTLOG or WINEVTLOG_XML

Hi,
The short answer is: use the WINEVTLOG parser.
WINEVTLOG_XML is mainly for legacy ingestion methods, such as NXLog in XML mode.

You can use the following documentation:

• BindPlane:
  https://docs.bindplane.com/how-to-guides/google-secops/using-google-secops-with-bindplane-best-practices

• Google:
  https://docs.cloud.google.com/chronicle/docs/ingestion/default-parsers/winevtlog#configure-bindplane-agent

Hi ​@Eoved : Thanks for your response.

Below are the configurations we tested :

SecOps standardization processor in Bindplane Processor : WINEVTLOG

When WINEVTLOG is used as the log_type, no events are ingested into SecOps.

Events start appearing only after enabling the Raw Logs option in the Advanced Settings of the Windows Event Source configuration.

However, once Raw Logs are enabled, the entire payload is ingested into the Body field in Bindplane. This makes it difficult for us to apply additional processors/filters, such as dropping specific Event IDs.

Could you please suggest how we can address this issue or recommend the correct approach to handle filtering while using WINEVTLOG?

Hi,
That’s correct  Raw Logs should be enabled, as described in the BindPlane documentation:

The raw logs are enabled on the source, while the filtering should be applied on Processor 1 (or Processor 2, but I assume that’s not the case here).
 

You can apply multiple actions on a single processor.

There are a couple of methods to reduce these Event IDs, but I’ll give you the straightforward options:
Filter by condition or filter by regex.
(Note: “Filter by condition” is available for Free and Enterprise licenses. BindPlane for Google customers must use “Filter by regex”.)

Choose the Event ID field you want to filter and apply an exclude filter.

You can use the following documentation:
https://docs.bindplane.com/integrations/processors/filter-by-condition
https://docs.bindplane.com/integrations/processors/filter-by-regex