LOGbinder Blog

Updates, Tips and News   RSS Feed  

In-depth How To's for Windows Event Collection

Mon, 28 Aug 2017 13:36:35 GMT

Here at LOGbinder we have been deep in the weeds with Windows Event Forwarding/Collection (WEC or WEF) for quite some time now.  In the past month since we’ve released Supercharger for WEC and opened our new forums for WEC and also Supercharger.  This has resulted in many of you asking questions and finding new challenges with WEC. 

For example, a few Supercharger users have recently asked about workstation status outside of work hours like weekends and holidays.  As you know, one of the benefits of a Supercharged WEC environment is being able to see the health status of all your forwarders.  During weekends or holidays, a forwarder may be shutdown or sleeping until the user gets the machine online again.  During this workstation’s down time you don’t want a healthy workstation reporting as unhealthy in Supercharger.  This KB article explains a how to change a simple setting to keep this from happening.

Another situation that some users are dealing with is when they need to define expected forwarders by some AD criteria other than an AD group.  For example, you create a subscription targeting “Domain Computers” but you only want a subset of the computers running Windows 10 in this group to forward events.  We have had users scratching their heads trying to figure out if this is possible without creating new AD groups which can take time, especially if you are working with thousands of forwarders like some of our users.  This KB article explains how to do this using LDAP filters in Superchargers Deterministic Subscription Policies.

We will do our best to keep you updated with tips and tricks to get your WEC Supercharged.  In the meantime, feel free to browse the “How To” section in our Support Portal to see if you are missing out on any of our latest articles and tips.


Randy releases two new "How-To" Videos

Wed, 21 Jun 2017 13:55:45 GMT
Randy Franklin Smith, guru at UltimateWindowsSecurity.com, just released two new "How-To" video's on monitoring two important areas with Windows Event Collection.

Video 1 - In this 4 minute video, Randy shows you step-by-step how you can use Supercharger to create a WEC susbscription that pulls PowerShell security events from all of your endpoints to a central collector.

Video 2 - In this 8 minute video, Randy shows you how to monitor security event ID 4688 from all of your endpoints. Obviously this would normally create a plethora of data but using Supercharger's Common System Process noise filter you will see how you can leave 60% of the noise at the source.

You can watch the video's by clicking on the links above or visiting the resources page for Supercharger by clicking here.

Supercharger Free Edition is Now Available

Wed, 14 Jun 2017 08:58:44 GMT

It’s been an exciting 3 months or so since we released Supercharger for Windows Event Collection and we have even more exciting news to share: We just released a new and free edition of Supercharger for Windows Event Collection which you can get here

There are no time-outs and no limits on the number of computers you can manage with Supercharger Free.

We wanted to include more than enough functionality so that anyone who uses WEC would want to install Supercharger Free right away.  For non-WEC users, Free Edition helps you get off the ground with step-by-step guidance. 

With Supercharger Free you can stop remoting into each collector and messing around with Event Viewer just to see the status of your subscriptions.  You can see all your collectors, subscriptions and source computers on a single pane of glass – even from your phone.  And you can create/edit/delete subscriptions as necessary.

We also wanted to help you get more from WEC’s ability to filter out noise events at the source by leveraging my research on the Windows Security Log. 

Supercharger Free Edition:

  • Provides a single pane of glass view of your entire Windows Event Collection (WEC) environment across all collectors and domains
  • Virtually eliminates the need to remote into collectors and wrestle with Event Viewer.  You can manage subscriptions right from the dashboard
  • Includes a growing list of my personally-built Security Log noise filters that help you get the events you need while leaving the noise behind

The manager only takes a few minutes to install and can even co-exist on a medium loaded collector.  Then it’s just seconds to install the agent on your other collectors.  You can uninstall Supercharger without affecting your WEC environment. 

We hope Supercharger Free is something that saves you time and helps you accomplish more with WEC.

This is just the beginning.  We’ve got more exciting and free stuff coming.  But you’ll need at least Supercharger Free to make use of what’s next, so install it today if you can.


How to Monitor Active Directory Changes for Free: Using Splunk Free, Supercharger Free and the New Splunk App for LOGbinder

Fri, 02 Jun 2017 13:35:28 GMT
No matter how big or small you are, whether you have budget or not – you need to be monitoring changes in Active Directory.  There are awesome Active Directory audit solutions out there.  And ideally you are using one of them.  But if for whatever reason you can’t, you still have AD and it still needs to be monitored.  This solution helps you do just that.  

Yesterday during Randy Franklin Smith’s webinar: How to Monitor Active Directory Changes for Free: Using Splunk Free, Supercharger Free and My New Splunk App we released a version of our Splunk App for LOGbinder.  Not only is this application free, but with the help of our just announced free edition of Supercharger for Windows Event Collection, we demonstrate the power of WEC’s Xpath filtering to deliver just the relevant events to Splunk Free and stay within the 500MB daily limit of Splunk Light’s free limitations.  It’s a trifecta free tools that produces this:
 

Among other abilities, our new Splunk App puts our deep knowledge of the Windows Security Log to work by analyzing events to provide an easy to use but powerful dashboard of changes in Active Directory.  You can see what’s been changing in AD sliced up

by object type (users, groups, GPOs, etc)
by domain
by time
by administrator

Too many times we see dashboards that showcase the biggest and highest frequency actors and subjects but get real – most of the time what you are looking for is the needle – not the haystack.  So we show the smallest, least frequent actors and objects too.  


 
Just because it’s free doesn’t mean it’s low value.  We put some real work into this.  We always learn something new about or own little AD lab environment when we bring this app up.  To make this app work we had to make some improvements to how Splunk parses Windows Security Events.  The problem with stuff built by non-specialists is that it suffices for filling in a bullet point like “native parsing of Windows Security Logs” but doesn’t come through when you get serious about analysis.  Case-in-point: Splunk treats these 2 very different fields in the below event as one:


 
As you can see rsmith created the new user cmartin.  But checkout what Splunk does with that event:


Whoah! So there’s no different between the actor and the target of a critical event like a new account being created?  One Splunker tells me they have dealt with this issue by ordinal position but we are frightened that actor and target could switch positions.  Anyway, it’s ugly.  Here’s what the same vent looks like once you install our Splunk App:


That’s what we’re talking about! Hey, executives may say that’s just the weeds but we know that with security the devil is in the details.  

Now, you knowledgeable Splunkers out there are probably wondering if we get these events by defining them at index time.  And the answer is “no”.  Randy provided the Windows Security Log brains but we got a real Splunker to build the app and you’ll be happy to know that Imre defined these new fields as search time fields.  So this works on old events already indexed and more importantly doesn’t impact indexing.  We tried to do this right.

Plus, we made sure this app works whether you consume events directly from the Security log each computer or via Windows Event Collection (which is what we recommend with the help of Supercharger). 
 
To learn more about the over all solution please watch the webinar which is available on demand at https://www.ultimatewindowssecurity.com/webinars/watch.aspx?ID=1439

For those of you new to Splunk, we’ll quickly show you how to install Splunk Free and our Splunk App.  Then we’ll show you how in 5 minutes or our free edition of Supercharger for Windows Event Collection can have your domain controllers efficiently forwarding just the relative trickle of relevant change events to Splunk.  Then we’ll start rendering some beautiful dashboards and drilling down into those events.  We will briefly show you how this same Splunk app can also analyze SharePoint, SQL Server and Exchange security activity produced by our LOGbinder product and mix all of that activity with AD changes and plot it on a single pane of glass.

Or checkout the solution page at https://www.logbinder.com/Solutions/ActiveDirectory where there are links to the step-by-step directions.

And if you are already proficient with Splunk and collecting domain controller logs you can get the Splunk app at https://www.logbinder.com/Resources/ and look under SIEM Integration.  

For technical support please use the appropriate forum at forum.logbinder.com 

Supercharger for Windows Event Collection Now Available – Save 50% on Enterprise Edition

Mon, 27 Feb 2017 15:34:10 GMT

No matter what SIEM you use, this is big news because collecting logs from hundreds or thousands of Windows endpoints is a constant pain point. But it doesn’t have to be if you use the technology already built-in to Windows to eliminate agents AND polling.

We are thrilled to announce the availability of Supercharger – a brand-new and one-of-a-kind solution for quickly implementing and managing the native Windows Event Collection already built-in to your servers and workstations.

Already using WEC? Supercharger will instantly give you time back and help you improve security and operational efficiency.

New to WEC? Supercharger will accelerate your implementation and help make it a roaring success.

Supercharger for Windows Event Collection manages all your collectors from a single pane of glass providing instant visibility into the health of your environment from the domain level down to each individual forwarder.

Features:

  • Every collector, subscription and forwarder computer in your environment on a single pane of glass
  • Alerts when any subscription's healthy forwarder percentage falls below your threshold; by email or inform your systems management solution
  • Load balance hundreds of thousands of forwarder computers across multiple collectors
  • Deep analysis of forwarder computers correlating Active Directory computer and group information with WEC source data
    • Deterministic - Enumerate each AD group assigned to subscription and compare against source computers reported by WEC - taking into account computer's status in AD
    • Empirical - Compare current active forwarders to past activity
    • Arbitrary - Strict tracking foor smaller, high value forwarder sets
  • Purge old WEC sources from collectors
  • Build safe Security Log filters that leave the noise at the source
  • Leverage expert knowledge on the Security Log from Randy Franklin Smith's UltimateWindowsSecurity.com
  • Enforce consistent WEC configuration policies across collectors and subscriptions
  • Track collector and event logging performance for tuning and capacity planning

Save 50% on Enterprise Edition

Install a trial of Supercharger in the next week and get the promo code for Enterprise Edition at Standard pricing! https://www.logbinder.com/Form/SCDownload

Instant pricing is available here: https://www.logbinder.com/Products/Supercharger/Pricing

Let us know how you like Supercharger and what you’d like to see us add. We’ve got some very cool enhancements in store but we also want to hear from you. Install Supercharger today, it only takes a few minutes to have complete visibility over your entire WEC environment.


previous | next

powered by Bloget™