best way to configure Windows devices for WinRM and add as event source

[JeremySamiec]

I would like to know the best way to configure windows servers and add them to NetWitness. The process I have right now (Windows Event Forwarding) has its own set of issues and would like something more native to NetWitness. However, manually running of scripts on a bunch of host servers (over 10K Windows servers) is not reliable and then having to create and import CSV's is another manual process.

is there anything more automated and enterprise friendly?

[MihaMesojedec · Accepted solution]

You can use MS GPO option and official RSA Powershell script (winrmconfig.ps1) to configure WinRM settings on your machines.

https://community.rsa.com/community/products/netwitness/parser-network/event-sources#M  

WinRM Diagnostic Tool  

I created small PS script (not official RSA script) which you can add at the end of the "winrmconfig.ps1" script and this will automatically add your hosts to RSA NetWitness via REST API interface on your Log Collector. Only manual step is to create Event Category in your Log Collector and then define parameters in REST API powershell script.

Event sources will be added to Log Collector with FQDN (test.domain.com). If you want to change this then you need to modify powershell script to grab IP of machine and pass it to REST API call.

[JeremySamiec]

This is awesome, thank you!

Now, I am not an admin on the RSA NW servers, what permissions are required to connect to the REST API? Is this configurable on the log collector 'role permissions' page?

I would like to create a local acct that only has access to the REST API to perform the actions of the script, but am not sure what/how to ask the admin to set the permissions.

Thank you very much

[MihaMesojedec]

You need to define Role (for example "Rest_API") and User (for example "rsaapi") in your Log Collector (LC) to have access only to Rest API on your LC.

User will have access to manage only LC via Rest API, but NO option to access NetWitness via GUI. 

Output when script is successfully executed.

 

[JeremySamiec]

Thank you, I will try that when the admin is available.

I appreciate the help.

[MihaMesojedec]

I don't think you can be more granular in permissions and limit user to configure only Windows events sources via Rest API.

Make sure you have access to port 50101 on your LC(s).

You can always modify iptables on your Log Decoder and limit access to LC from specific subnets to port 50101. When you are done with configuration you can always remove iptables rule.

[JeremySamiec]

Do you know if there is a reason the REST API would not respond over 50101 on some log collectors? 

[MihaMesojedec]

Connection restrictions on Log Decoder (check iptables) or your Firewall rules.

[JeremySamiec]

What is the script you ran to test the API?

[MihaMesojedec]

Script attached to this post, but I rename it when I attached it here.

As well you can enable SSL for REST API, but then you need to change powershell script to accept certificate for LC or ignore it.

Here is how you enable SSL for REST API.

You need to restart LC service, before settings take effect.