# SIEM not ingesting Forwarded Windows logs

**URL:** <https://discuss.elastic.co/t/siem-not-ingesting-forwarded-windows-logs/207311>\
**Category:** SIEM\
**Created:** [November 11, 2019, 9:26am UTC](https://discuss.elastic.co/t/siem-not-ingesting-forwarded-windows-logs/207311 "2019-11-11T09:26:22Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![mustdiee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mustdiee/32/57464_2.png) [@mustdiee](https://discuss.elastic.co/u/mustdiee)\
**Post date:** [November 11, 2019, 9:26am UTC](https://discuss.elastic.co/t/siem-not-ingesting-forwarded-windows-logs/207311/1 "2019-11-11T09:26:22Z")

</div>

Hello!  
I'am collecting logs from all Windows PCs in my infrastructure with EventForwarding. Only one server has a winlogbeat installed, which is configured on other workstations as a subscription server (this is the easier way to collect than deploying winlogbeat around all domain PCs). When I upgraded to 7.x, I noticed that SIEM does not ingest forwarded events. Is there any solution that will help SIEM ingest such data?

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [November 12, 2019, 12:19pm UTC](https://discuss.elastic.co/t/siem-not-ingesting-forwarded-windows-logs/207311/2 "2019-11-12T12:19:08Z")

</div>

Hi, can you share your `winlogbeat.yml` configuration file as well as the debug logs from winlogbeat?

---

<div class="post-metadata">

**Author:** ![mustdiee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mustdiee/32/57464_2.png) [@mustdiee](https://discuss.elastic.co/u/mustdiee)\
**Post date:** [November 12, 2019, 2:48pm UTC](https://discuss.elastic.co/t/siem-not-ingesting-forwarded-windows-logs/207311/3 "2019-11-12T14:48:34Z")

</div>

My winlogbeat.yml:

> **conf**
>
> winlogbeat.event\_logs:
> 
> - name: ForwardedEvents  
> ignore\_older: 1440h  
> setup.template.enabled: true  
> setup.ilm.enabled: true  
> setup.template.name: "winlogbeat-%{[agent.version]}"  
> setup.template.pattern: "winlogbeat-\*"  
> setup.kibana:  
> host: "ip:5601"  
> output.elasticsearch:  
> hosts: ["ip:9200"]  
> logging.level: debug  
> logging.path: "C:/Program Files/Winlogbeat/logs"

And 4624 event example from debug log

> **log**
>
> 2019-11-12T17:38:22.126+0300 DEBUG [processors] processing/processors.go:183 Publish event: {  
> "@timestamp": "2019-11-12T14:25:23.740Z",  
> "@metadata": {  
> "beat": "winlogbeat",  
> "type": "\_doc",  
> "version": "7.4.2"  
> },  
> "message": "An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nLogon Type:\t\t\t3\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-7\n\tAccount Name:\t\tАНОНИМНЫЙ ВХОД\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x22b47c1ea\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x0\n\tProcess Name:\t\t-\n\nNetwork Information:\n\tWorkstation Name:\tpc2\n\tSource Network Address:\t10.0.0.1\n\tSource Port:\t\t58593\n\nDetailed Authentication Information:\n\tLogon Process:\t\tNtLmSsp \n\tAuthentication Package:\tNTLM\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\tNTLM V1\n\tKey Length:\t\t128\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.",  
> "winlog": {  
> "channel": "Security",  
> "api": "wineventlog",  
> "computer\_name": "[pc1.company-local.ru](http://pc1.company-local.ru)",  
> "process": {  
> "thread": {  
> "id": 520  
> },  
> "pid": 1024  
> },  
> "event\_id": 4624,  
> "provider\_name": "Microsoft-Windows-Security-Auditing",  
> "provider\_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}",  
> "event\_data": {  
> "IpAddress": "10.0.0.1",  
> "IpPort": "58593",  
> "LmPackageName": "NTLM V1",  
> "TargetLogonId": "0x22b47c1ea",  
> "LogonGuid": "{00000000-0000-0000-0000-000000000000}",  
> "ProcessName": "-",  
> "TargetUserSid": "S-1-5-7",  
> "TargetDomainName": "NT AUTHORITY",  
> "LogonType": "3",  
> "TransmittedServices": "-",  
> "ProcessId": "0x0",  
> "SubjectUserSid": "S-1-0-0",  
> "SubjectDomainName": "-",  
> "SubjectLogonId": "0x0",  
> "AuthenticationPackageName": "NTLM",  
> "TargetUserName": "АНОНИМНЫЙ ВХОД",  
> "LogonProcessName": "NtLmSsp ",  
> "KeyLength": "128",  
> "WorkstationName": "pc2",  
> "SubjectUserName": "-"  
> },  
> "record\_id": 3750389098,  
> "task": "Logon"  
> },  
> "ecs": {  
> "version": "1.1.0"  
> },  
> "host": {  
> "name": "glb-elc-01"  
> },  
> "agent": {  
> "type": "winlogbeat",  
> "ephemeral\_id": "f7607acd-3c24-4db8-844c-e6a6e4b4f19c",  
> "hostname": "glb-elc-01",  
> "id": "b4f3347c-dc64-44a1-a7a7-8bb3a6442003",  
> "version": "7.4.2"  
> },  
> "event": {  
> "code": 4624,  
> "action": "Logon",  
> "created": "2019-11-12T14:38:22.126Z",  
> "kind": "event"  
> },  
> "log": {  
> "level": "information"  
> }  
> }

---

<div class="post-metadata">

**Author:** ![mustdiee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mustdiee/32/57464_2.png) [@mustdiee](https://discuss.elastic.co/u/mustdiee)\
**Post date:** [November 14, 2019, 6:29am UTC](https://discuss.elastic.co/t/siem-not-ingesting-forwarded-windows-logs/207311/4 "2019-11-14T06:29:49Z")

</div>

Does anyone have good experience with ingesting forwarded events to SIEM?

---

<div class="post-metadata">

**Author:** ![mustdiee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mustdiee/32/57464_2.png) [@mustdiee](https://discuss.elastic.co/u/mustdiee)\
**Post date:** [November 14, 2019, 10:33am UTC](https://discuss.elastic.co/t/siem-not-ingesting-forwarded-windows-logs/207311/5 "2019-11-14T10:33:03Z")

</div>

I figured out this problem adding

> ```
> processors:
> - script:
> lang: javascript
> id: security
> file: ${path.home}/module/security/config/winlogbeat-security.js
> 
> ```

in my winlogbeat.yml  
Now i want to see all "source computers" in Hosts table SIEM UI, but there is only winlogbeat agent (subscription server). Is there any way to edit request for SIEM hosts?

---

<div class="post-metadata">

**Author:** ![mustdiee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mustdiee/32/57464_2.png) [@mustdiee](https://discuss.elastic.co/u/mustdiee)\
**Post date:** [November 14, 2019, 5:54pm UTC](https://discuss.elastic.co/t/siem-not-ingesting-forwarded-windows-logs/207311/6 "2019-11-14T17:54:34Z")

</div>

Found solution [here](https://github.com/elastic/beats/issues/13920)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 12, 2019, 5:54pm UTC](https://discuss.elastic.co/t/siem-not-ingesting-forwarded-windows-logs/207311/7 "2019-12-12T17:54:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.