The Trellix Helix NXLOG configuration for the x64 (64-bit) architecture is shown below.
...
############################################################################
# NXLOG Configuration for Threat Analytics Platform (TAP) #
# Windows 64-bit Default Configuration - Version 1.5.4 #
# Created by Evan Davison- 27 June, 2014 - UPDATED by Adam Goff 8 FEB 2019 #
# Requires NXLOG version 2.8.1248 or greater #
#############################################################################
## DO NOT MODIFY MODULE NAMES AS IT MAY BREAK TAP FUNCTIONALITY
########################################
# Global Directives #
########################################
## Do not remove or modify unless instructed or you experience issues at startup.
## Set the ROOT to the folder nxlog was installed to, otherwise application will not start.
# define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
LogLevel INFO
#############################################################
# Windows Vista/Win7/2008/2012/Win10/2016 Eventlog Includes #
#############################################################
## WARNING!! DO NOT UNCOMMENT MORE THAN ONE(1) MS_EVENTLOG INCLUDE!!
include %ROOT%\conf\ms_vistalog.conf
## Must add "ms_vistalog" as INPUT to route below.
# include %ROOT%\conf\ms_vistalog_filtered.conf
## Must add "ms_vistalog_filter" as INPUT to route below.
# include %ROOT%\conf\ms_vistalog_advanced.conf
## Must add "ms_vistalog_adv" as INPUT to route below.
################################################################
# Windows Windows XP/2000/2003 & earlier Eventlog Includes #
################################################################
## WARNING!! DO NOT UNCOMMENT MORE THAN ONE(1) MS_EVENTLOG INCLUDE!!
# include %ROOT%\conf\ms_eventlog_legacy.conf
## Must add "ms_eventlog" as INPUT to route below.
# include %ROOT%\conf\ms_eventlog_legacy_filtered.conf
## Must add "ms_eventlog_filter" as INPUT to route below.
# include %ROOT%\conf\ms_eventlog_advanced.conf
## Must add "ms_eventlog_adv" as INPUT to route below.
########################################
# Application Configuration Includes #
########################################
## Uncomment additional input modules below if desired.
## Additional configuration may be required for each application in its conf file.
# include %ROOT%\conf\ms_dhcpv4.conf
## Must add "MS_DHCPv4" as INPUT to route below.
# include %ROOT%\conf\ms_dhcpv6.conf
## Must add "MS_DHCPv6" as INPUT to route below.
# include %ROOT%\conf\ms_dns.conf
## Must add "MS_DNS" as INPUT to route below.
# include %ROOT%\conf\ms_exchange15.conf
## Must add "MS_EXCH_MT" as INPUT to route below.
# include %ROOT%\conf\ms_netlogon.conf
## Must add "MS_NETLOGON" as INPUT to route below.
# include %ROOT%\conf\ms_iis.conf
## Must add "MS_IIS" or "MS_FTP" or "MS_SMTP" as INPUT to route below.
########################################
# Output Module Includes #
########################################
## Uncomment additional OUTPUT modules below if desired.
## You MUST configure an IP or Hostname in each output conf file.
include %ROOT%\conf\output_tcp.conf
## Must add "tcp_sender1" as OUTPUT to route below
# include %ROOT%\conf\output_udp.conf
## Must add "udp_sender1" as OUTPUT to route below
# include %ROOT%\conf\output_encrypted.conf
## Must add "ssl_sender1" as OUTPUT to route below
# include %ROOT%\conf\output_file.conf
## Must add "file_sender1" as OUTPUT to route below
########################################
# Default Route #
########################################
## Add additional INPUTS comma separated on LEFT of arrow symbol.
## Add additional OUTPUTS comma separated on RIGHT of arrow symbol.
<Route 1>
#Primary route for log processing and forwarding.
Path ms_vistalog => tcp_sender1
</Route>
<Route 2>
#Please DO NOT modify route 2
#tcp_sender2 or udp_sender2 can be used and must be processed by a json parser
Path internal => tcp_sender2
</Route>
#############################################################################
#############################################################################
## DO NOT MODIFY BELOW CONFIGURATIONS UNLESS INSTRUCTED TO DO SO.
########################################
# Global Extensions #
########################################
## Do not modify extensions as they may be required by included configurations.
<Extension _charconv>
Module xm_charconv
AutodetectCharsets iso8859-2, utf-8, utf-16, utf-32
</Extension>
<Extension _syslog>
Module xm_syslog
IETFTimestampInGMT TRUE
</Extension>
<Extension _json>
Module xm_json
</Extension>
<Extension _exec>
Module xm_exec
</Extension>
########################################
# NXLOG Internal Logging #
########################################
## Provides logging of NXLOG application. Please do not modify.
<Input internal>
Module im_internal
Exec $class = "nxlog";\
$metaclass = "windows,application";\
$rawmsghostname = hostname_fqdn();\
$rawmsgip = host_ip();\
$hostname = hostname();\
rename_field("EventTime", "eventtime");\
rename_field("Hostname", "hostname");\
rename_field("EventType", "priority");\
rename_field("Severity", "severity");\
rename_field("ProcessID", "processid");\
rename_field("Message", "msg");\
rename_field("SourceName", "program");\
rename_field("EventReceivedTime", "detectedtime");\
rename_field("SourceModuleName", "source");\
rename_field("SourceModuleType", "filetype");\
delete($SeverityValue);\
to_syslog_json
Exec create_stat("nxhourly", "RATE", 3600); add_stat("nxhourly", 1);
<Schedule>
#Hourly NXLOG rate monitoring
Every 3600 sec
Exec if defined get_stat("nxhourly") \
{\
log_warning(get_stat("nxhourly") + " NXLOG internal log messages in past 1 hour"); \
}
</Schedule>
</Input>