LGrep - Syslog Collector and Analyzer

LGrep implements syslog and Windows Event Forwarding (WEF) collectors, feeding data to Datalog analysis engine.

Configure Remote System Logging with Rsyslog

Ubuntu

Edit the /etc/rsyslog.d/10-rsyslog.conf file:

*.* @10.0.2.2:1514

Restart the rsyslog service:

$ service rsyslog restart

CentOS

Edit the /etc/rsyslog.conf file:

*.* @10.0.2.2:1514

Restart the rsyslog service:

$ service rsyslog restart

Configure Remote System Logging with Windows Log Forwading

Open Local Group Policy Editor (gpedit.msc) and navigate to:

Local Computer Policy
|
+-Computer Configuration
  |
  +-Administrative Templates
    |
    +-Windows Components
      |
      +-Event Forwarding

Open Configure target Subscription Manager:

1. Check Enabled

2. Open SubscriptionManagers with the Show…​ button

3. Configure target subscription manager with the value:

   Server=https://<FQDN/IP of collector>:5986/wsman/SubscriptionManager/WEC,Refresh=<seconds>,IssuerCA=<Thumbprint of the CA issuing TLS client authentication certificate>

   winrm qc -transport:https

TODO

https://docs.microsoft.com/en-us/windows/desktop/wec/setting-up-a-source-initiated-subscription https://github.com/nsacyber/Event-Forwarding-Guidance/tree/master/Subscriptions/samples