nxlog.conf file for x32 (32-bit) architecture

Prev Next

The Trellix Helix NXLOG configuration for the x32 architecture is shown below.

...
############################################################################
# NXLOG Configuration for Threat Analytics Platform (TAP)                    
# Windows 32-bit Default Configuration - Version 1.5.4                        # Created by Evan Davison - 27 June, 2014 - UPDATED by Adam Goff 8 FEB 2019   # Requires NXLOG version 2.8.1248 or greater                                  ############################################################################

## DO NOT MODIFY MODULE NAMES AS IT MAY BREAK TAP FUNCTIONALITY

########################################
# Global Directives                    #
########################################
 
## Do not remove or modify unless instructed or you experience issues at startup.
## Set the ROOT to the folder nxlog was installed to, otherwise application will not start.

define ROOT C:\Program Files\nxlog
# define ROOT C:\Program Files (x86)\nxlog
  
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
LogLevel INFO

############################################################# 
# Windows Vista/Win7/2008/2012/Win10/2016 Eventlog Includes # 
#############################################################

## WARNING!! DO NOT UNCOMMENT MORE THAN ONE(1) MS_EVENTLOG INCLUDE!!

include %ROOT%\conf\ms_vistalog.conf
## Must add "ms_vistalog" as INPUT to route below.

# include %ROOT%\conf\ms_vistalog_filtered.conf
## Must add "ms_vistalog_filter" as INPUT to route below.

# include %ROOT%\conf\ms_vistalog_advanced.conf 
## Must add "ms_vistalog_adv" as INPUT to route below.
			
################################################################
# Windows Windows XP/2000/2003 & earlier Eventlog Includes     #
################################################################
			
## WARNING!! DO NOT UNCOMMENT MORE THAN ONE(1) MS_EVENTLOG INCLUDE!!

# include %ROOT%%\conf\ms_eventlog_legacy.conf
## Must add "ms_eventlog" as INPUT to route below.
			
# include %ROOT%\conf\ms_eventlog_legacy_filter" as INPUT to route below.
## Must add "ms_eventlog_filter" as INPUT to route below.
			
# include %ROOT%\conf\ms_eventlog_legacy_advanced.conf
## Must add "ms_eventlog_adv" as INPUT to route below.

########################################
# Application Configuration Includes   #
########################################
			
## Uncomment additional INPUT modules below if desired.
## Additional configuration may be required for each application in its conf file.
			
# include %ROOT%\conf\ms_dhcpv4.conf
## Must add "MS_DHCPv4" as INPUT to route below.
			
# include %ROOT%\conf\ms_dhcpv6.conf
## Must add "MS_DHCPv6" as INPUT to route below.
			
# include %ROOT%\conf\ms_dns.conf
## Must add "MS_DNS" as INPUT to route below.
			
# include %ROOT%\conf\ms_exchange15.conf
## Must add "MS_EXCH_MT" as INPUT to route below.
			
# include %ROOT%\conf\ms_netlogon.conf
## Must add "MS_NETLOGON" as INPUT to route below.
			
# include %ROOT%\conf\ms_iis.conf
## Must add "MS_IIS" or "MS_FTP" or "MS_SMTP" as INPUT to route below.

########################################
# Output Module Includes               #
########################################
 
## Uncomment additional OUTPUT modules below if desired.
## You MUST configure an IP or Hostname in each output conf file.

include %ROOT%\conf\output_tcp.conf
## Must add "tcp_sender1" as OUTPUT to route below

# include %ROOT%\conf\output_udp.conf
## Must add "udp_sender1" as OUTPUT to route below

# include %ROOT%\conf\output_encrypted.conf
## Must add "ssl_sender1" as OUTPUT to route below

# include %ROOT%\conf\output_file.conf
## Must add "file_sender1" as OUTPUT to route below
			
########################################
# Default Route                        #
########################################
			
## Add additional INPUTS comma separated on LEFT of arrow symbol.
## Add additional OUTPUTS comma separated on RIGHT of arrow symbol.
			
<Route 1>
       #Primary route for log processing and forwarding.
       Path    ms_vistalog => tcp_sender1
</Route>
			
<Route 2>
       #Please DO NOT modify route 2
          #tcp_sender2 or udp_sender2 can be used and must be processed by a json parser
          Path internal => tcp_sender2
</Route>

#############################################################################
#############################################################################
			
## DO NOT MODIFY BELOW CONFIGURATIONS UNLESS INSTRUCTED TO DO SO.
			
			
########################################
# Global Extensions                    #
########################################
			
## Do not modify extensions as they may be required by included configurations.
			
<Extension _charconv>
   Module  xm_charconv
   AutodetectCharsets iso8859-2, utf-8, utf-16, utf-32
</Extension>
			
<Extension _syslog>
   Module  xm_syslog
   IETFTimestampInGMT  TRUE
</Extension>
			
<Extension _json>
   Module  xm_json
</Extension>

<Extension _exec>
   Module  xm_exec
</Extension>
			
########################################
# NXLOG Internal Logging               #
########################################
			
## Provides logging of NXLOG application. Please do not modify.
			
<Input internal>
    Module  im_internal
    Exec    $class = "nxlog";\
            $metaclass = "windows,application";\
            $rawmsghostname = hostname_fqdn();\
            $rawmsgip = host_ip();\
            $hostname = hostname();\
            rename_field("EventTime", "eventtime");\
            rename_field("Hostname", "hostname");\
            rename_field("EventType", "priority");\
            rename_field("Severity", "severity");\
            rename_field("ProcessID", "processid");\
            rename_field("Message", "msg");\
            rename_field("SourceName", "program");\
            rename_field("EventReceivedTime", "detectedtime");\
            rename_field("SourceModuleName", "source");\
            rename_field("SourceModuleType", "filetype");\
            delete($SeverityValue);\
                    to_json();
   Exec    create_stat("nxhourly", "RATE", 3600); add_stat("nxhourly", 1);
   <Schedule>
 #Hourly NXLOG rate monitoring
 Every     3600 sec
 Exec      if defined get_stat("nxhourly") \
 {\
   log_warning(get_stat("nxhourly") + " NXLOG internal log messages in past 1 hour"); \
 }
 </Schedule>
</Input>