Viewfinity configuration

Configure the broker/sender system

1. Configure the broker/sender system using the Trellix installation guide and information provided by Trellix support.

2. Run the sender-post-install.sh script on the broker/sender.

3. Install and configure ntpd.

   Important

   While this step is optional, Trellix highly recommends performing this step. NTP provides a consistent timestamp across the network components. This timestamp is necessary for accurate analysis of network activities.

4. Verify the sender is connected to Trellix Helix:

   [root@VFTAP ~]# netstat -apn | grep sender
   ...
   tcp 0 0 192.168.10.76:33684 tap_receiver_IP:443 ESTABLISHED 5472/./sbin/sender
   ...

   Status that does not show ESTABLISHED probably means that there is no connection to Trellix Helix.

Install and configure nxlog

1. Download and install nxlog from the following URL:

   http://nxlog-ce.sourceforge.net/download

2. Configure the nxlog file as shown below:

   Note

   For more information on configuring nxlog, see the nxlog documentation at: http://nxlog-ce.sourceforge.net/nxlog-docs/en/nxlog-reference-manual.html.

   The configuration file is located in the following directory: NXLOGINSTALL_DIR\conf\nxlog.conf.

   When you have finished your configuration, it should look as follows:

   #================================
   define ROOT C:\Program Files\nxlog
   #define ROOT C:\Program Files (x86)\nxlog Moduledir %ROOT%\modules
   CacheDir %ROOT%\data
   Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data
   LogFile %ROOT%\data\nxlog.log
   <Extension charconv> Module xm_charconv
   AutodetectCharsets utf-8, ucs-2le
   </Extension>
   <Input vf_acss> Module im_file
   #VVVVVVVV Directory that contains results of vf_offline_converter. File "C:\\Temp\\input\\Local Group Policy\\Access\\\*"
   Exec convert_fields("ucs-2le", "utf-8")
   SavePos True
   </Input>
   <Input vf_lnch> Module im_file
   #VVVVVVVV Directory that contains results of vf_offline_converter. File "C:\\Temp\\input\\Local Group Policy\\Launch\\\*"
   Exec convert_fields("ucs-2le", "utf-8"); SavePos True
   </Input>
   <Input vf_newf> Module im_file
   #VVVVVVVV Directory that contains results of vf_offline_converter. File "C:\\Temp\\input\\Local Group Policy\\Updates\\\*"
   Exec convert_fields("ucs-2le", "utf-8"); SavePos True
   </Input>
   <Output out> Module om_tcp
   #VVVVVVVVV Sender/broker IP/HOST Host 192.168.10.76
   Port 514
   </Output>
   #VVVVVVV LOCAL FILE FOR VERIFICATION - NOT REQUIRED! Useful
   for data verification VVVVVVVV
   <Output lf> Module om_file
   File "C:\\Temp\\out.txt"
   </Output>
   <Route
   Path vf_acss,vf_lnch,vf_newf => out
   </Route>
   #VVVVVVV LOCAL FILE FOR VERIFICATION - NOT REQUIRED! Useful
   for data verification VVVVVVVV
   <Route 2>
   Path vf_acss,vf_lnch,vf_newf => lf
   </Route>
   #======================

3. After nxlog is configured and running, verify that nxlog is connected to sender/broker.

   To verify the connection, run the netstat -apn | grep sender command on the broker/sender host.

   If successful, you should see the following:

   tcp 0 0 192.168.10.76:514 NXLOG_IP:60481 ESTABLISHED 5472/./sbin/sender

Run the vf_offline_converter command configured with appropriate directories:

<?xml version="1.0" encoding="utf-8"?>
<!-- Example of configuration to be passed to vf_event_converter.exe -->
<Configuration>
    <!-- Directory with raw events; includes GPO GUID; MUST be present -->
    <SourceDirectory>C:\Temp\share\Local Group Policy</SourceDirectory>
    <!-- Directory to write converted events to; Optional parameter;
			if not present, events will be written under SourceDirectory\ConvertedEvents -->
    <DestinationDirectory addGPOid- d="true">c:\temp\input</DestinationDirectory>
    <!-- Directory to keep temporary files in; Optional parameter; 
			default is Temp directory for user running the tool -->
    <TempDir></TempDir>
    <!-- Maximum number of lines in CSV files; Optional parameter; default is 10000 -->
    <MaxCsvLines>10000</MaxCsvLines>
    <!-- Maximum run duration in seconds; Optional parameter; default is 0, i.e., run until done -->
    <MaxDuration>0</MaxDuration>
    <!-- Analyze and write file source; Optional parameter, 
			default false; NOTE: incurs HEAVY CPU and time overhead! -->
    <AnalyzeFileSource>false</AnalyzeFileSource>
    <!-- Process all types of events simultaneously; Optional parameter, default true -->
    <ConcurrentProcessing>True</ConcurrentProcessing>
    <!-- Put headers for columns; Optional parameter, default true -->
    <PutHeaders>True</PutHeaders>
</Configuration>

Verify that the sender receives data.

1. Verify that sender receives data from log source (nxlog):

   tcpdump -ni eth1 -c 50 -s 0 -A udp port 514

2. Verify that sender sends data to Trellix Helix:

   tcpdump -ni eth1 -c 50 tcp port 443

   Note

   For all this to work, Viewfinity events must be written to share and that share must be accessible by vf_offline_converter. Currently, vf_offline_converter writes to files in Unicode, particularly ucs-2le encoding. Even after encoding conversion, Trellix Helix receives an empty line after each line with data. In the hex editor, it looks like 4E 37 58 33 32 5C 54 65 6D 70 2C 0D 0A 0D 0A.

   Windows programs such as Notepad and Excel can handle double crlf, but Wordpad and most UNIX software displays empty lines.