nxlog ssl tls

nxlog.conf file for sending logs over ssl. Copy this file from server /opt/data/etc/remote_connection/certificates/ca.crt

to windows machine . c:\Program Files\nxlog\cert

Replace 192.168.15.118 ip with your siem server ip then restart the nxlog service from the Window system.

Panic Soft

define ROOT C:\Program Files\nxlog

#ModuleDir %ROOT%\modules

#CacheDir %ROOT%\data

#SpoolDir %ROOT%\data

define CERTDIR %ROOT%\cert

define CONFDIR %ROOT%\conf

# Note that these two lines define constants only; the log file location

# is ultimately set by the `LogFile` directive (see below). The

# `MYLOGFILE` define is also used to rotate the log file automatically

# (see the `_fileop` block).

define LOGDIR %ROOT%\data

define MYLOGFILE %LOGDIR%\nxlog.log

# By default, `LogFile %MYLOGFILE%` is set in log4ensics.conf. This

# allows the log file location to be modified via NXLog Manager. If you

# are not using NXLog Manager, you can instead set `LogFile` below and

# disable the `include` line.

#LogFile %MYLOGFILE%

LogLevel INFO

LogFile %MYLOGFILE%

#include %CONFDIR%\log4ensics.conf

<Extension _syslog>

Module xm_syslog

</Extension>

<Extension _exec>

Module xm_exec

</Extension>

<Extension _json>

Module xm_json

</Extension>

<Input in>

Module im_msvistalog

ReadFromLast TRUE

<QueryXML>

<QueryList>

<Query Id='1'>

<Select Path='Application'>*</Select>

<Select Path='Security'>*</Select>

<Select Path='System'>*</Select>

</Query>

</QueryList>

</QueryXML>

</Input>

<Output out>

#Module om_tcp

Module om_ssl

Host 192.168.15.118

Port 515

CAFile %CERTDIR%/ca.crt

AllowUntrusted TRUE

Exec to_json();$Message=$raw_event;to_syslog_bsd();

</Output>

<Route 1>

Path in => out

</Route>

Please let us know if this helped you or not.