# Blumira : Windows NXLog to Blumira Sensor
# 
# NXLog configuration for converting and sending Windows logs to Blumira
# Both Community and Enterprise Editions of NXLog are supported.  If you
# intend to collect WEF logs, you must use Enterprise Edition which you
# will need to license internally.
#
# Core features:
# - Functions correctly with 2003 and sysmon
# 
# 20200205 - Tested on Server 2003
#
#
# Reminder:
# - Remember to restart your nxlog service after every change that could add new data
#   net stop nxlog && net start nxlog
# 
# Note:
# - IF you're downloading this it means that you are using an EOL server. Please reach out
#   to Blumira support if they have not yet sent you their hardening guide for 2003.

#####################
# Definitions
# 1 Task, update define SENSOR A.B.C.D to your IP
#####################
# Please set SENSOR to the IP address of your Blumira sensor
define SENSOR A.B.C.D
define PORT 514

# Please set ROOT to the folder your nxlog was installed into
# - if 64bit is used, comment out (#) non-x86 and uncomment C:\Program Files (x86)\nxlog lines
define ROOT C:\Program Files\nxlog
define ROOT_STRING C:\Program Files\nxlog
#define ROOT C:\Program Files (x86)\nxlog
#define ROOT_STRING C:\Program Files (x86)\nxlog
# Define certs if used during Sensor Logger creation
define CERTDIR %ROOT%\cert
define CONFDIR  %ROOT%\\conf
# Define internal log details for NXLog
define LOGDIR   %ROOT%\data
define LOGFILE  %LOGDIR%\nxlog.log 
 
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
#LogFile %ROOT%\data\nxlog.log
LogFile %LOGFILE%
 
#####################
# Definitions
# 0 Tasks
#####################
<Extension _fileop>
    Module xm_fileop

    # Check the size of our log file hourly, rotate if larger than 5MB
    <Schedule>
        Every   1 hour
        Exec    if (file_exists('%LOGFILE%') and \
                   (file_size('%LOGFILE%') >= 5M)) \
                    file_cycle('%LOGFILE%', 8);
    </Schedule>

    # Rotate our log file every week on Sunday at midnight
    <Schedule>
        When    @weekly
        Exec    if file_exists('%LOGFILE%') file_cycle('%LOGFILE%', 8);
    </Schedule>

</Extension>
 
<Extension json>
    Module      xm_json
</Extension>
 
<Extension syslog>
    Module xm_syslog
</Extension>

<Extension File operations>
    Module xm_fileop 
</Extension>


#############################
# Internal NXLog Logs START #
#############################
<Input blu_internal>
    Module im_internal
    # Drop if a log file is not found, likely IIS or FW are not configured
    Exec if ($Message =~ /does not exist/) drop();
    # Drop if IIS or old Windows logs are not found
    # If you're using Win 2k3 or lower, please reach out to support@blumira.com
    Exec if ($Message =~ /failed to subscribe to msvistalog/) drop();
    Exec  $Message = to_json(); 
</Input>

<Output blu_out_internal>
    Module om_tcp
    Host %SENSOR%
    Port %PORT%

    Exec to_syslog_bsd();
</Output>

<Route route_internal>
    Path blu_internal => blu_out_internal
</Route>


#############################
#  Internal NXLog Logs END  #
#############################

############################
# Windows Event Logs START #
############################
#!!!!!!!!!!!!!!!!!!!!!!!!!!!
# 1 Potential Task - If on XP/2000/2003
#!!!!!!!!!!!!!!!!!!!!!!!!!!!
<Input blu_eventlog>

    #im_mseventlog line for Windows XP/2000/2003
    Module im_mseventlog
    
    # Workaround for local time so as to standardize to absolute microseconds since epoch
    Exec $EventTime = integer($EventTime);

    # JSON is required because some Windows logs contain new-line characters.
    Exec $Message = to_json();
</Input>

<Output blu_out_eventlog>
    Module om_tcp
    Host %SENSOR%
    Port %PORT%

    Exec to_syslog_bsd();
</Output>

<Route route_eventlog>
    Path blu_eventlog => blu_out_eventlog
</Route>
############################
#  Windows Event Logs END  #
############################
