An important step in SIEM deployments is to collect logs from servers on which your infrastructure, applications and middleware run.
The event collection from servers is to be seen in the 2nd step in a 3 step approach in SIEM deployment, first step being network and network security devices and last step being the applications.
Microsoft proposes a well-designed log collection infrastructure with 2 options left to the administrators. Both methods use WinRM protocol and are safer than collecting logs using RPC.
In the first method, the collector server connects to event sources and pulls the logs with the help of a domain user which is added to the Event Log Readers group. This method is known as “Collector Initiated Event Forwarding” in Microsoft world and can be better remembered as PULL method. This is the easier method but does not scale well in large environments and may be inefficient as the collector server should regularly contact event sources whether they have logs to transmit or not.
In the second method, which I will detail more in this article, event sources push logs to a collector server over http or https. This method is known as “Source Initiated Subscription” and can be better remembered as PUSH method. This method scales much better to larger environments and is definitely more secure when https option is used as transmission protocol. This method requires less configuration when configured through Group Policy. However special attention must be paid for the collector server when logs are sent over https, especially about listener configuration as it is not that well documented on Microsoft’s documentation and needs good system administration skills.
EVENT SOURCE CONFIGURATION
First of all, the winrm service should be activated from the command line with winrm quickconfig command.
In the Local Group Policy Editor, under Computer Configuration -> Administrative Templates -> Windows Components -> Event Forwarding menu, “Configure the server address, refresh interval, and issuer certificate authority of a target Subscription Manager” setting should be configured as below:
At this point you can prefer to use http or https protocols to transmit your logs to the collector server. The only difference at the event source is the port numbers used for http and https protocols which are 5985 and 5986 respectively as shown below:
Server=http://Servername.Domain:5985/wsman/Subscription Manager/WEC,Refresh=60
Server=https://Servername.Domain:5986/wsman/Subscription Manager/WEC,Refresh=60
Log sending period is chosen as 60 seconds in these examples.
Once event forwarding configuration is done, the group policy must be updated with gpupdate /force command.
In Local Security Policy screen, audit policy settings under Security Setttings -> Local Policies -> Audit Policy should be configured. It is recommended to enable logging for both successful and failed attempts for all policy items except “Audit object access”, as this setting may generate too many logs if both successful and failed attempts are logged. I recommend configuring this setting only for failed attempts for the beginning and deciding later according to the criticality of the server.
EVENT COLLECTOR CONFIGURATION
First of all, Windows Event Collector service and WinRM service should be enabled from the command line by using wecutil qc and winrm qc commands respectively.
After this step, Event Viewer is launched and a new Subscription should be created by right clicking on Subscriptions menu item and selecting Create Subscription or selecting from the menu on the right.
Once the Create Subscription window opens, for source initiated subscriptions settings are configured as below. These settings largely depend on your own needs however there are real life experiences to follow such as collecting logs in “Hardware Events” destination as logs from this folder are correctly parsed at Arcsight and need no further efforts.
Subscription name: Event collection
Destination log: Hardware Events
Subscription type: Source computer initiated
Configuration ends after this step and if there are no problems, like firewall rules blocking the traffic, you should be seeing transferred logs in your target log collection folder. The best way to check if there is a problem or not is to use "Runtime Status" option from the menu on the right.
For more details you can read the Technet article below:
