SIEM not ingesting Forwarded Windows logs

Elastic Security SIEM
1

Hello!
I'am collecting logs from all Windows PCs in my infrastructure with EventForwarding. Only one server has a winlogbeat installed, which is configured on other workstations as a subscription server (this is the easier way to collect than deploying winlogbeat around all domain PCs). When I upgraded to 7.x, I noticed that SIEM does not ingest forwarded events. Is there any solution that will help SIEM ingest such data?

2

Hi, can you share your winlogbeat.yml configuration file as well as the debug logs from winlogbeat?

3

My winlogbeat.yml:

conf

winlogbeat.event_logs:

  • name: ForwardedEvents
    ignore_older: 1440h
    setup.template.enabled: true
    setup.ilm.enabled: true
    setup.template.name: "winlogbeat-%{[agent.version]}"
    setup.template.pattern: "winlogbeat-*"
    setup.kibana:
    host: "ip:5601"
    output.elasticsearch:
    hosts: ["ip:9200"]
    logging.level: debug
    logging.path: "C:/Program Files/Winlogbeat/logs"

And 4624 event example from debug log

log

2019-11-12T17:38:22.126+0300 DEBUG [processors] processing/processors.go:183 Publish event: {
"@timestamp": "2019-11-12T14:25:23.740Z",
"@metadata": {
"beat": "winlogbeat",
"type": "_doc",
"version": "7.4.2"
},
"message": "An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nLogon Type:\t\t\t3\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-7\n\tAccount Name:\t\tАНОНИМНЫЙ ВХОД\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x22b47c1ea\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x0\n\tProcess Name:\t\t-\n\nNetwork Information:\n\tWorkstation Name:\tpc2\n\tSource Network Address:\t10.0.0.1\n\tSource Port:\t\t58593\n\nDetailed Authentication Information:\n\tLogon Process:\t\tNtLmSsp \n\tAuthentication Package:\tNTLM\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\tNTLM V1\n\tKey Length:\t\t128\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.",
"winlog": {
"channel": "Security",
"api": "wineventlog",
"computer_name": "pc1.company-local.ru",
"process": {
"thread": {
"id": 520
},
"pid": 1024
},
"event_id": 4624,
"provider_name": "Microsoft-Windows-Security-Auditing",
"provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}",
"event_data": {
"IpAddress": "10.0.0.1",
"IpPort": "58593",
"LmPackageName": "NTLM V1",
"TargetLogonId": "0x22b47c1ea",
"LogonGuid": "{00000000-0000-0000-0000-000000000000}",
"ProcessName": "-",
"TargetUserSid": "S-1-5-7",
"TargetDomainName": "NT AUTHORITY",
"LogonType": "3",
"TransmittedServices": "-",
"ProcessId": "0x0",
"SubjectUserSid": "S-1-0-0",
"SubjectDomainName": "-",
"SubjectLogonId": "0x0",
"AuthenticationPackageName": "NTLM",
"TargetUserName": "АНОНИМНЫЙ ВХОД",
"LogonProcessName": "NtLmSsp ",
"KeyLength": "128",
"WorkstationName": "pc2",
"SubjectUserName": "-"
},
"record_id": 3750389098,
"task": "Logon"
},
"ecs": {
"version": "1.1.0"
},
"host": {
"name": "glb-elc-01"
},
"agent": {
"type": "winlogbeat",
"ephemeral_id": "f7607acd-3c24-4db8-844c-e6a6e4b4f19c",
"hostname": "glb-elc-01",
"id": "b4f3347c-dc64-44a1-a7a7-8bb3a6442003",
"version": "7.4.2"
},
"event": {
"code": 4624,
"action": "Logon",
"created": "2019-11-12T14:38:22.126Z",
"kind": "event"
},
"log": {
"level": "information"
}
}

4

Does anyone have good experience with ingesting forwarded events to SIEM?

5

I figured out this problem adding

processors:
 - script:
    lang: javascript
    id: security
   file: ${path.home}/module/security/config/winlogbeat-security.js

in my winlogbeat.yml
Now i want to see all "source computers" in Hosts table SIEM UI, but there is only winlogbeat agent (subscription server). Is there any way to edit request for SIEM hosts?

6

Found solution here

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.