Forwarding Windows event data to RSA Analytic - issues and options

[ebailey]

I am trying to use syslog forwarding to send Windows event data to RSA Analytics and it is not working. Any ideas? This is just for systems events as a test, but I intend to use this for application and security logs as well.

props

[source::wineventlog:system]
TRANSFORMS-rsa = send_to_rsa

transforms

[send_to_rsa]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = rsa

any ideas?

Is using syslog forwarding the preferred way to integrate with RSA Analytic or would the CEF app be a better option.

Thanks!

[maciep]

Just to verify, your source is actually wineventlog:system? all lowercase?

We have a similar setup here, and have added some additional info to the props.conf stanza. We're sending security events, so it might be different, but we borrowed the settings from this blog entry (in the comment section)
http://blogs.splunk.com/2013/10/14/windows-event-logs-in-splunk-6/

[WinEventLog:Security]
TRANSFORMS-1_syslog_routing = route_to_some_syslog

SHOULD_LINEMERGE = true
MAX_TIMESTAMP_LOOKAHEAD=30
LINE_BREAKER = ([\r\n](?=\d{2}/\d{2}/\d{2,4} \d{2}:\d{2}:\d{2} [aApPmM]{2}))
REPORT-MESSAGE = wel-message, wel-eq-kv, wel-col-kv
KV_MODE=none
TRANSFORMS-FIELDS = strip-winevt-linebreaker
SEDCMD-win=s/(?mis)(Token Elevation Type indicates|This event is generated|Application Id=).*$//g
SEDCMD-rmlines=s/[\n\r\t]/ /g

Our transforms looks like yours but the outputs is a bit different.

[syslog:some_syslog]
server = some_ip:514
type=udp
maxEventSize = 4096
timestampformat = %b %e %H:%M:%S

Not sure if this will be helpful, but maybe point you in the right direction?

[maciep]

can you elaborate a bit on what "not working" means? On which server are you configuring your props and transforms? Can you also share your outputs.conf?

[ebailey]

not working means no data that matches source::wineventlog:system is being forwarded to RSA

This is a test server with a steady flow of events. I can see events hitting the indexer that should match the filter.

outputs.conf

[syslog:rsa]
server = xxxxx:514
type = udp

Thanks

Ed