How to collect Microsoft Windows AD data

Note. This feature is subject to the terms of the Chronicle Service Pre-GA offer.
Special conditions. Pre-GA features may have limited support and modifications, and pre-GA features may not be compatible when using other pre-GA releases.
See Chronicle Support Recommendations for more information.
and special conditions of the Service Chronicle.

Preview

This document:

describes the architecture of the deployment and the required steps, if any
Configuration that generates the logs supported by Chronicle Analyzer
for Microsoft https://userchronicles.com Active Directory events. You can find an overview in Chronicles
For information about receiving data, see the section “Receive data” in the Chronicle.

contains information about how the parser matches fields in the source forest
to the fields of the Chronicle unified data model.

Record label and: WINDOWS_AD

Supported Versions And Devices

Chronicles Analyzer maintains community Microsoft Windows Server build logs.
Microsoft Windows Server comes with the following themes: Foundation, Essentials,
Switch and data center. Schema Registration Script Generated by Parallel Inference
no different.

Microsoft Server 2019

Microsoft Windows Server 2016

Microsoft Server Glass 2012

Chronicle Analyzer supports logs collected by NXLog Community or Enterprise.
output.

Supported Protocol Types

The history analyzer will definitely parse and normalize the data returned from
user context
what is it
asset context. Logs are supported by generated English text and are not
supported by magazines created in languages ​​other than English.

Deployment Architecture

This table lists the recommended items required for deployment.
Microsoft Windows Event Purchase Architecture. Each client will almost certainly have a different deployment.
this representation and is likely to be more complex. The following is usually required:

All systems in the deployment structures are configured using UTC.
Time zone.

A Powershell script is created and configured directly in each Microsoft Windows AD forum.
Gather USER_CONTEXT and ASSET_CONTEXT data.

NXLog uses any commercial Microsoft Windows server to send data to the central office.
Microsoft Windows or Linux server.

Chronicle is installed on a central Microsoft Windows or Linux server via a redirector
Move log entry to Chronicle.

Setting Up Microsoft Devices

Configure Windows AD Server

Steps for configuring Microsoft Windows AD Servers on your architecture:

1. Set up all systems with UTC workspace.
2. Create and configure one on each Windows Microsoft Active Directory server.
   Zero Powershell program to collect log data for each output file. NXLog reads information
   Creates and sends data to a Microsoft Windows or Linux master server.

3. Create any powershell script. See example below. change it
   $OUTPUT_FILENAME value relative to where the output database should be
   letter. This file will still be read by NXLog. Data needs to be stored a bit more in JSON
   Format. Set encoding to path to utf8. Instead use filter like
   -LDAPFilter despite calling Get-ADUser and
   Cmdlets Get-ADComputer.

   # Specify where to write the log file
   $OUTPUT_FILENAME="
   
   "
   
   If (Test-Path -Path $OUTPUT_FILENAME) Remove-Item -path $OUTPUT_FILENAME -ErrorAction SilentlyContinue
   
   # USER_CONTEXT: translates all Active Directory users into their properties.
   Get-ADUser -Filter * -properties samAccountName | % ConvertTo-JSON -compression
   
   # ASSET_CONTEXT: Retrieves all Active Directory assets with their properties.
   Get-ADComputer -Filter * -properties samAccountName | % ConvertTo-JSON -compression
   

4. Create a recurring pro task that runs an illegal program to extract and write important information.
   output file.

   1. Open the Task Scheduler application.
   2. Click “Create a task” in the appropriate area.
   3. Enter the desired task name and description.

   4. Check “Run with highest privileges” to
      all important information is restored.

   5. On the Triggers tab, specify when you want to repeatdo this task.

   6. On the Action tab, add a new action and expand the action scope.
      the file where the script will be saved.

5. Install the NXLog agent on a single Microsoft Windows Active Directory server. application
   This redirects the logs to the main Microsoft Windows or Linux servers.
   keep an eye on it
   NXLog documentation.

6. Create a configuration file for each individual instance of NXLog. Using NXLog
   im_file with
   The module reads the file and breaks the lines into fields. v
   Om_tcp usage module
   Move the data to be transferred to a central Microsoft Windows or Linux server.

   Here is an example build of NXLog. Replace with

   
   Destination City Information Values ​​Microsoft Windows or Linux
   Server. In the section, above this File property, add the file
   The path to the output log file written with the powershell script. Always Organize
   DirCheckInterval and PollInterval. If they are definitely not installed, NXLog
   Requests for electronic files every 1 second.

   

   define ROOT C:\Program Files\nxlog
   setupGo to ADCONTEXT_OUTPUT_DESTINATION_ADDRESS 
   Set ADCONTEXT_OUTPUT_DESTINATION_PORT 
   
   Modules directory %ROOT%\modules
   CacheDir %ROOT%\data
   PID FILE %ROOT%\data\nxlog.pid
   SpoolDir %ROOT%\data
   Log file %ROOT%\data\nxlog.log
   
   
       im_file module
       File ""
       Dircheckinterval 3600
       Polling interval 3600
   
   
   
       om_tcp module
       node %ADCONTEXT_OUTPUT_DESTINATION_ADDRESS%
       Port %ADCONTEXT_OUTPUT_DESTINATION_PORT%
   
   
   
       path in_adcontext => this out_chronicle_adcontext
   
   

7. Start the NXLog service on both systems.

Setting Up A Microsoft Windows And Linux Central Server

See See Installing and configuring forwarding on Linux.
or Install and configure call forwarding in Microsoft Windows
for more information on installing and configuring the entire redirector.

1. Set up the system with UTC time zone.
2. Install the Chronicle redirector from a Microsoft Windows or Linux central server.

3. Set up Chronicle forwarding to link logs to Chronicle.
   Here is the instance forwarding configuration.

    - syslog:
         together:
           included: true
           Data type: windows_ad
          package_n_seconds: 10
           lot_n_bytes: 1048576
         TCP address: 0.0.0.0:10518
         connection_timeout_sec: 60
   

Field Mapping Reference: Procedure Fields To Event UDM Fields

The Once section describes how the parser used Microsoft Windows Active Directory in biblical times.
The Fields event on the way to the Chronicle Unified Data Model Specialties event.

User Context Logs