Windows Event#

Integration Details

Ingester

Windows Event Ingester

Kit

Windows Kit

Windows Event Configuration#

A well-defined collection strategy and data management are key to achieving data omniscience, especially with logs as cumbersome as those formatted in XML, and thus it is recommended to consider the following:

Plan your collection strategy accordingly for your environment

Consider the following to create your use cases:

  • Ingestion Strategy

    • Local vs Remote: Will the Windows Events ingester be deployed locally on each target system, or will you use a Windows Event Collection (WEC) server?

    • Scale: Identify the total number of target systems to monitor and if multiple collectors are required to manage load or simplify collection across diverse subnets and DMZs.

    • Network Trust: Is a Federator required to securely traverse untrusted networks or restricted segments?

  • Resource & Change Management

    • Hardware Allocation: Ensure available infrastructure (CPU, RAM, and Storage) meets the requirements of your desired setup.

    • Agility: Consider if a configuration change is needed, how quickly/accurately can it be changed across your environment?

[Option 1] Deploy locally (to individual windows systems)#

Run the .msi installation wizard to install the Gravwell events service. On first installation, the installation wizard will prompt to configure the indexer endpoint and ingest secret. Subsequent installations and/or upgrades will identify a resident configuration file and will not prompt.

Note

The Log Level selection is for internal logging only; it does not affect which Windows events are captured by the ingester. Setting the level to Information will cause the ingester to emit log events when it starts, stops, and attaches to event Channels.

The ingester is configured with the config.cfg file located at %PROGRAMDATA%\gravwell\eventlog\config.cfg. The configuration file follows the same form as other Gravwell ingesters with a [Global] section configuring the indexer connections and multiple EventChannel definitions.

To modify the indexer connection or specify multiple indexers, change the connection IP address to the IP of your Gravwell server and set the Ingest-Secret value. This example shows configuring an encrypted transport:

Ingest-Secret=YourSecretGoesHere
Encrypted-Backend-target=ip.addr.goes.here:port

Once configured, this file can be copied to any other Windows system from which you would like to collect events.

For silent installation or troubleshooting steps: Windows Event Ingester

[Option 2] Windows Event Forwarding#

The Gravwell Windows Event ingester can be combined with Windows Event Forwarding (WEF) to simplify deployments and reduce the number of endpoints the ingester must be installed on. Windows Event Forwarding is an integrated Windows service that forwards events to a central collection point using integrated Windows functionality. More information on WEF can be found on several Microsoft resources.

Configuring Windows Event Forwarding is beyond the scope of this document, but actually collecting the forwarded events is very simple.

First you will need to install the Windows Event ingester on the Windows system that will be receiving the forwarded events. Then you will want to validate the name of the channel that is configured to receive the forwarded events on the collection box. Typically that is ForwardedEvents.

Note

Forwarded events will still contain the correct Channel in their logs.

[Option 3] Deploy in an AD Domain environment with a WEC Server#

Note

It is recommended that collector servers be placed in a central location relative to their source systems (i.e., the same forest and network as the source systems) as well as their destination (i.e., the Gravwell indexer).

1) Create the collector GPO:#

  • Set the Wecsvc (Windows Event Collector) and WinRM (Windows Remote Management) services to start automatically

  • For WinRM client, set the following:

    • Allow Basic authentication: Disabled

    • Allow unencrypted traffic: Disabled

    • Disallow Digest authentication: Enabled

      • Consider setting “Trusted Hosts” and/or only allowing Kerberos authentication

    • Desired audit policy (unless already configured)

  • For WinRM service, set the following:

    • Allow Basic authentication: Disabled

    • Allow unencrypted traffic: Disabled

    • Disallow WinRM from storing RunAs credentials: Enabled

      • Consider disabling “Allow remote server management through WinRM”, only allowing Kerberos authentication, and/or setting “Specify channel binding token hardening level” (when using HTTPS)

2) Create the source GPO:#

  • Set the WinRM (Windows Remote Management) service to start automatically

  • For WinRM client, set the following:

    • Allow Basic authentication: Disabled

    • Allow unencrypted traffic: Disabled

    • Disallow Digest authentication: Enabled

      • Consider setting “Trusted Hosts” and/or only allowing Kerberos authentication

  • For WinRM service, set the following:

    • Allow Basic authentication: Disabled

    • Allow unencrypted traffic: Disabled

    • Disallow WinRM from storing RunAs credentials: Enabled

      • Consider disabling “Allow remote server management through WinRM” if remote management of these computers should be disabled and/or only allowing Kerberos authentication as this is the most secure option available for authentication

3) Once GPOs are pushed and the servers/clients have been restarted, proceed:#

  • Verify by opening PowerShell on the target system and running:

    • Get-GPO -Name "NAME OF SOURCE GPO"

  • If results come back, the GPO has been applied to the target system; otherwise an error indicates the GPO has not been applied. Check if the GPO has been linked to the target system’s OU or if a linked WMI filter is causing this by opening Group Policy Management.

4) Copy over the XML files for the desired level of event collection and run the following for each:#

  • wecutil cs "PATH_TO_XML"

5) To validate this was successful, perform one of the following:#

  • wecutil es (to show all WEC subscriptions)

  • Open Event Viewer, select “Subscriptions” from the left tree menu

6) Lastly, verify the “Forwarded Events” log is:#

  • At least sized to the maximum recommended view size: 4194240

  • Configured to your desired retention setting

7) Once each client system updates group policy, you should see events showing up in the “Forwarded Events” log#

Gravwell Configuration#

Gravwell Storage Well Configuration#

Setup the well configuration in your Gravwell indexers.

Sample well config:
Create or edit: /opt/gravwell/etc/gravwell.conf.d/windowsevent-well.conf

[Storage-Well "windowsevent"]
    Location=/opt/gravwell/storage/windowsevent
    Tags=win*

Note

The sysmon tag in the sample configuration below is stored in the well from the Sysmon guide (Tags=sysmon*). If you have not created that well, create it before you add the sysmon channel.

Gravwell Ingester Configuration: Windows Event#

Sample Windows Event config:
Create or edit: %PROGRAMDATA%\gravwell\eventlog\config.cfg

[Option 1] Deploy locally (to individual windows systems)#

[EventChannel "system"]
    Tag-Name=windows
    Channel=System #pull from the system channel

[EventChannel "sysmon"]
    Tag-Name=sysmon
    Channel="Microsoft-Windows-Sysmon/Operational"
    Max-Reachback=24h # reachback must be expressed in hours (h), minutes (m), or seconds (s)

[EventChannel "Application"]
    Channel=Application # pull from the application channel
    Tag-Name=winApp # Apply a new tag name
    Provider=Windows System # Only look for the provider "Windows System"
    EventID=1000-4000 # Only look for event IDs 1000 through 4000
    EventID=1,2,3,4 # also look for events 1, 2, 3, and 4
    Level=verbose # Only look for verbose entries
    Max-Reachback=72h #start looking for logs up to 72 hours in the past
    Request-Buffer=16 # use a large 16MB buffer for high throughput
    Request-Size=1024 # Request up to 1024 entries per API call for high throughput

[EventChannel "System Critical and Error"]
    Channel=System # pull from the system channel
    Tag-Name=winSysCrit # Apply a new tag name
    Level=critical # look for critical entries
    Level=error # AND for error entries
    Max-Reachback=96h # start looking for logs up to 96 hours in the past

[EventChannel "Security prune"]
    Channel=Security # pull from the security channel
    Tag-Name=winSec # Apply a new tag name
    EventID=-400 # ignore event ID 400
    EventID=-401 # AND ignore event ID 401

[Option 2] Windows Event Forwarding#

[EventChannel "WEF Events"]
    Tag-Name=windows
    Channel=ForwardedEvents

[Option 3] Deploy in an AD Domain environment with a WEC Server#

Events arrive on the WEC server via the same ForwardedEvents channel as [Option 2], so the same [EventChannel "WEF Events"] stanza shown above applies here.

Note

Remember to restart the gravwell service via standard windows service management to apply the new config.