2017-04-26 08:42 AM
Any support or planned support for NXLOG for windows collection? Lots of customer doesn't want to use Snare.
2017-04-26 08:45 AM
Is using winrm as a collection method an alternative?
I would have thought it was easier to set up as it can be controlled via domain policy and also scripted to be deployed in large environments.
2017-04-26 09:22 AM
Or what about the built in windows collection method (using WinRM) Windows Event Collection (WEC/WEF) which works as push or pull and then collect from one central windows server witn WinRM to RSA NW ?
2017-04-27 07:42 AM
Have you found anything out about RSA leveraging reverse DNS lookups for WEF? If users leveraged a subscription server, how are the endpoints/relay identified?
2017-04-27 08:35 AM
event.computer contains the true client
device.ip contains the subscription server ip address
no word on the reverse lookups function
2017-05-04 02:52 AM
For winrm, how to failover to another VLC automatically? Customer wanted to use nxlog(same as snare) to send as syslog format, so can use load balancer to failover.
2018-02-08 06:09 PM
For my experience, I prefer syslog to Winrm, u other send methods.
Well you can try whit this nxlog.conf
Exec to_syslog_snare(); $raw_event = replace($raw_event, "\t", ',');
Path in => out
Also update your win snare parse from Live.
Your language system on windows must be English (EEUU), not work for other language. If you know about win snare parser for spanish version please let me know.