# Blumira : Windows NXLog to Blumira Sensor
# 
# NXLog configuration for converting and sending Windows logs to Blumira
# Both Community and Enterprise Editions of NXLog are supported.  If you
# intend to collect WEF logs, you must use Enterprise Edition which you
# will need to license internally.
#
# Core features:
# - only captures useful Windows Event IDs
# - avoids significant packet volume taking down logger
# - handles message sending to Sensor
# 
# 20191015 - Tested on Server 2012/2016/2019
#
# Changelog:
# - Made IIS Event Viewer default to On, polling non-existent is non-impacting to hosts
#
# Reminder:
# - Remember to restart your nxlog service after every change that could add new data
#   net stop nxlog && net start nxlog

#####################
# Definitions
# 1 Task, update define SENSOR A.B.C.D to your IP
#####################
# Please set SENSOR to the IP address of your Blumira sensor
define SENSOR A.B.C.D
define PORT 514

# Please set ROOT to the folder your nxlog was installed into
# - if 64bit is used, comment out (#) x86 and uncomment C:\Program Files\nxlog lines
#define ROOT C:\Program Files\nxlog
#define ROOT_STRING C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog
define ROOT_STRING C:\Program Files (x86)\nxlog
# Define certs if used during Sensor Logger creation
define CERTDIR %ROOT%\cert
define CONFDIR  %ROOT%\\conf
# Define internal log details for NXLog
define LOGDIR   %ROOT%\data
define LOGFILE  %LOGDIR%\nxlog.log 
 
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
#LogFile %ROOT%\data\nxlog.log
LogFile %LOGFILE%
 
#####################
# Definitions
# 0 Tasks
#####################
<Extension _fileop>
    Module xm_fileop

    # Check the size of our log file hourly, rotate if larger than 5MB
    <Schedule>
        Every   1 hour
        Exec    if (file_exists('%LOGFILE%') and \
                   (file_size('%LOGFILE%') >= 5M)) \
                    file_cycle('%LOGFILE%', 8);
    </Schedule>

    # Rotate our log file every week on Sunday at midnight
    <Schedule>
        When    @weekly
        Exec    if file_exists('%LOGFILE%') file_cycle('%LOGFILE%', 8);
    </Schedule>

</Extension>
 
<Extension json>
    Module      xm_json
</Extension>
 
<Extension syslog>
    Module xm_syslog
</Extension>

<Extension File operations>
    Module xm_fileop 
</Extension>


#############################
# Internal NXLog Logs START #
#############################
<Input blu_internal>
    Module im_internal
    # Drop if a log file is not found, likely IIS or FW are not configured
    Exec if ($Message =~ /does not exist/) drop();
    # Drop if IIS or old Windows logs are not found
    # If you're using Win 2k3 or lower, please reach out to support@blumira.com
    Exec if ($Message =~ /failed to subscribe to msvistalog/) drop();
    Exec  $Message = to_json(); 
</Input>

<Output blu_out_internal>
    Module om_tcp
    Host %SENSOR%
    Port %PORT%

    Exec to_syslog_bsd();
</Output>

<Route route_internal>
    Path blu_internal => blu_out_internal
</Route>


#############################
#  Internal NXLog Logs END  #
#############################

############################
# Windows Event Logs START #
############################
#!!!!!!!!!!!!!!!!!!!!!!!!!!!
# 1 Potential Task - If on XP/2000/2003
#!!!!!!!!!!!!!!!!!!!!!!!!!!!
<Input blu_eventlog>
    # Comment if on XP/2000/2003
    Module im_msvistalog

    #Uncomment im_mseventlog line for Windows XP/2000/2003
    #Module im_mseventlog

    # Prevent endless loop due to 5156 logging nxlog.exe connections
    Exec if ($SourceName == 'Microsoft-Windows-Security-Auditing' and $EventID IN (5156, 5157) and $Application =~ /\\nxlog\.exe$/i) drop();

    # Define Queries
    Query       <QueryList>\
                        <Query Id="0">\
                            <Select Path="Application">*</Select>\
                            <Select Path="System">*</Select>\
                            <Select Path="Security">*</Select>\
                            <Select Path="Setup">*</Select>\
                            <Select Path="Windows Powershell">*</Select>\
                            <Select Path="Microsoft-Windows-TaskScheduler/Operational">*</Select>\
                            <Suppress Path="Security">*[System[(EventID=4689 or EventID=5158 or EventID=5440 or EventID=5444)]]</Suppress> \
                            <Suppress Path="Windows PowerShell">*[System[(EventID=501 or EventID=400 or EventID=600)]]</Suppress> \
                        </Query>\
                    </QueryList> 
    
    # Filter out by Application
    Exec if ($Application =~ /nxlog\\nxlog.exe/) drop();

    # Filter out by Source and Destination IP   
    Exec if ($SourceAddress =~ /224.0.0.252/) drop();
    Exec if ($SourceAddress =~ /192.168.1.255/) drop();
    Exec if ($SourceAddress =~ /224.0.0.1/) drop();
    Exec if ($SourceAddress =~ /239.255.255.250/) drop();
    Exec if ($DestAddress =~ /224.0.0.22/) drop();

    # Filter out by Command Line    
    Exec if ($CommandLine =~ /"C:\\Program Files \(x86\)\\nxlog\\nxlog.exe" -c "C:\\Program Files \(x86\)\\nxlog\\conf\\nxlog.conf"/) drop();

    # Dropping non-security but often-loud logs for DFS and failed ISATAP issues
    #Exec if ($EventID == 4202 or $EventID == 4208 or $EventID == 4302 or $EventID == 4304 or $EventID == 5004) drop();\
    
    # Workaround for local time so as to standardize to absolute microseconds since epoch
    Exec $EventTime = integer($EventTime);

    # JSON is required because some Windows logs contain new-line characters.
    Exec $Message = to_json();
</Input>

<Output blu_out_eventlog>
    Module om_tcp
    Host %SENSOR%
    Port %PORT%

    Exec to_syslog_bsd();
</Output>

<Route route_eventlog>
    Path blu_eventlog => blu_out_eventlog
</Route>
############################
#  Windows Event Logs END  #
############################



#######################################
# Windows IIS Event Viewer Logs START #
#######################################
#!!!!!!!!!!!!!!!!!!!!!!!!!!!
# If you want to utilize IIS Logging through the Log Files, remove all # at the beginning of lines from <Input blu_eventlog_iis> to </Route> after route_eventlog_iis.  If you want to use Log Files
#
# 1 Potential Task - Run the following commands on the host(s) you want to collect
#                    logs from via Event Viewer, this will enable the logs. Running this
#                    command in your deployment script is OK. You will get errors on hosts
#                    that do not have IIS, they can be ignored.
#
# From an administrative command shell prompt
# - wevtutil sl Microsoft-IIS-Configuration/Administrative /e:true
# - wevtutil sl Microsoft-IIS-Configuration/Operational /e:true
# - wevtutil sl Microsoft-IIS-Logging/Logs /e:true
# Go to your IIS Manager, Server Configuration, select Logging and select "Both log file and ETW event" 
#!!!!!!!!!!!!!!!!!!!!!!!!!!!
<Input blu_eventlog_iis>
    Module im_msvistalog

    Query       <QueryList>\
                        <Query Id="0">\
                            <Select Path="Microsoft-IIS-Configuration/Administrative">*</Select>\
                            <Select Path="Microsoft-IIS-Configuration/Operational">*</Select>\
                            <Select Path="Microsoft-IIS-Logging/Logs">*</Select>\
                        </Query>\
                    </QueryList> 
        
    # Filter noise from IIS schema issues
    Exec if ($Message =~ /Unable to find schema/) drop();
    
    # Workaround for local time so as to standardize to absolute microseconds since epoch
    Exec $EventTime = integer($EventTime);

    # JSON is required because some Windows logs contain new-line characters.
    Exec $Message = to_json();
</Input>

<Output blu_out_eventlog_iis>
    Module om_tcp
    Host %SENSOR%
    Port %PORT%

    Exec to_syslog_bsd();
</Output>

<Route route_eventlog_iis>
    Path blu_eventlog_iis => blu_out_eventlog_iis
</Route>
#######################################
#  Windows IIS Event Viewer Logs END  #
#######################################

###############################
# Windows Firewall Logs START #
###############################
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
# If you want to utilize this section, remove all # at the beginning of lines from <Extension csv_windows_fw> to </Route> after route_windows_fw
#
# Task: You will need to ensure that logging is enabled for the Windows FW via GPO for Dropped packets only.
#       Adding successful packets will most likely be unnecessarily verbose unless you require visibility due to lack of segmentation.
#       Recommended Powershell Command - Requires FW to be configured to at least generally functional state
#       - Set-NetFirewallProfile –LogFileName %SystemRoot%\System32\LogFiles\Firewall\pfirewall.log -LogBlocked True -LogAllowed False -LogIgnored True
#       If _significant_ verbosity is required, use this command which will log Allowed connections as well:
#       - Set-NetFirewallProfile –LogFileName %SystemRoot%\System32\LogFiles\Firewall\pfirewall.log -LogBlocked True -LogAllowed True -LogIgnored True
#       --- Manual Setup ---
#       https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/configure-the-windows-firewall-log
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

<Extension csv_windows_fw>
    Module          xm_csv
    Fields          date, time, action, protocol, src-ip, dst-ip, src-port, dst-port, size, tcpflags, tcpsyn, tcpack, tcpwin, icmptype, icmpcode, info, path
    FieldTypes      string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string
    Delimiter       ' '
</Extension>

<Input blu_windows_fw>
    Module      im_file
    File        "C:\Windows\System32\LogFiles\Firewall\pfirewall.log"

    Exec if $raw_event =~ /^#/ drop();\
    {\
               csv_windows_fw->parse_csv();\
               $EventTime = parsedate($date + " " + $time);\
               $raw_event = to_json();\
    }

</Input>

<Output out_windows_firewall>
    Module      om_tcp
    Host        %SENSOR%
    Port        514
    Exec        $raw_event = 'BLU_WIN_FW: ' + $raw_event;
    
    Exec to_syslog_bsd();
</Output>

<Route route_windows_fw>
    Path        blu_windows_fw => out_windows_firewall
</Route>

###############################
#  Windows Firewall Logs END  #
###############################


################################
# Windows IIS Event Logs START #
################################
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
# This is the non-Event Viewer method, only use this method if you have a reason to not use Event Viewer
# ------------
# If you want to utilize IIS Logging through the Log Files, remove all # at the beginning of lines from <Extension w3c> to </Route> after route_iis.
#
# Warning: This should be duplicated for every additional site, e.g., W3SVC2, W3SVC3
# -----------
# Task: You will need to ensure that logging is enabled per site for IIS
# Task note: If you are storing logs in a different location than default, change File below to the appropriate path.
#            If you're unsure what to change it to, or, if you have more than one and are unsure
#            what the final output should be, please reach out to support@blumira.com with your configuration details.
#
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

#<Extension w3c>
#    Module xm_csv
#
#    Fields $date, $time, $s-ip, $cs-method, $cs-uri-stem, $cs-uri-query, $s-port, $cs-username, $c-ip, $csUser-Agent, $csReferer $sc-status, $sc-substatus, $sc-win32-status, $time-taken
#    FieldTypes string, string, string, string, string, string, string, string, string, string, string, string, string, string, string
#    Delimiter ' '
#    UndefValue -
#</Extension>

#<Input blu_iis_logs>
#    Module   im_file
#    File     "C:\\inetpub\\logs\\LogFiles\\W3SVC1\\u_ex*"
#    SavePos  TRUE
#    
#    Exec $Hostname = hostname_fqdn();
#    Exec if $raw_event =~ /^#/ drop();              \
#      else                          \
#          {                             \
#             w3c->parse_csv();              \
#             $EventTime = parsedate($date + " " + $time);   \
#             $raw_event = to_json();              \
#          }
#</Input>

#<Output blu_out_iis>
#    Module      om_udp
#    Host        %SENSOR%
#    Port        514
#    Exec        $raw_event = 'BLU_IIS: ' + $raw_event;
#    
#    Exec to_syslog_bsd();
#</Output>

#<Route route_iis>
#    Path blu_iis_logs => blu_out_iis
#</Route>

################################
#  Windows IIS Event Logs END  #
################################

