How does winlogbeat handle different OS languages

Elastic Stack Beats
1

Hello,

We use QRadar's wincollect for collecting windows event logs. During the process of windows server integration and since we might have different languages depend on the location (English, spanish or french) we encounter some problem with QRadar windows parser packages in languages other than English.

We're switching to Elastic SIEM and I wanna know how winlogbeat handles different languages. The only thing i found related to this was :

event.code
Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.

So how does it handle it? is it on the XML Level ? are we gonna have issues with certain languages
or in the long run ?

Thank you for the great work

2

Hi Hamza,

I found your question interesting so I shipped from windows in Spanish and Korean language, just as an example.
Now I am not sure what you are trying to do, but basically for the moment, the Event ID field event.code is the key to unify these events together. Let me show you a screenshot, maybe that makes it clearer.

field
field664×577 16.4 KB

And now the the e.g. log levels are still in local language:

field1

Apart from that it doesn't matter for tracking the SIEM itself as it is tracking down by some parameter like host name or the event.code as well, which are generalized by Elastic Common Schema.

fields2
fields21552×684 46.9 KB

https://www.elastic.co/guide/en/ecs/current/index.html

Now we do have a generalized content generalization, but nothing stops you as well already at ingest level to translate certain information at ingest level in winlogbeat using script processors, which are very flexible:
https://www.elastic.co/guide/en/beats/winlogbeat/master/processor-script.html
and migrate the fields into generalized content fields as well.

https://www.elastic.co/guide/en/ecs/current/migrating-to-ecs.html

We already have right now a couple fields generalizing content and work on even doing that better using Common Event Model like ECS event categorization.

See here for documentation.
https://www.elastic.co/guide/en/ecs/current/ecs-category-field-values-reference.html

I hope that makes things a bit more clear.

2 Likes
3

Thanks a lot @Andre_Letterer that was helpful

4

Perfect. Welcome to help.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.