Step 1: Configure collection
In this step, you configure a Local Windows Event Log Source to collect Microsoft Windows Event Log messages. You can configure the source on an existing Installed Collector or create a new collector. If you’re going to use an existing collector, jump to Configure a Local Windows Event Log Source below. Otherwise, create a new collector as described in Configure an Installed collector below, and then create the Local Windows Event Log Source on the collector.
Configure an Installed Collector
- In the Sumo Logic platform, select Manage Data > Collection > Collection.
- Click Add Collector.
- Click Installed Collector.
- The Add Installed Collector popup appears.
- Download the appropriate collector for your operating system.
- Install the collector. Instructions for your preferred operating system and method of installation are available on the Installed Collectors page.
- Once the collector is installed, confirm it is available on the Collection page and select Edit.
- The Edit Collector popup appears.
- Name. Provide a Name for the Collector.
- Description. (Optional)
- Category. Enter a string to tag the output collected from the source. The string that you supply will be saved in a metadata field called
- Fields. If you are planning that all the sources you add to this collector will forward log messages to CSE, click the +Add Field link, and add a field whose name is
_siemForwardand value is true. This will cause the collector to forward all of the logs collected by all of the sources on the collector to CSE.
Configure a Local Windows Event Log Source
- In the Sumo Logic web app, select Manage Data > Collection > Collection.
- Navigate to the Installed Collector where you want to create the source.
- Click Add Source next to the Installed Collector.
- Select Windows Event Log.
- The page refreshes.
- Name. Enter a name for the source.
- Description. (Optional)
- Source Host. (Optional) Enter a string to tag the messages collected from the source. The string that you supply will be saved in a metadata field called
- Source Category. Enter a string to tag the output collected from the source. The string that you supply will be saved in a metadata field called
_sourceCategory. Make a note of the source category. You’ll supply it in Step 2 below.
- Fields. If you have not configured the Installed Collector to forward all sources in the collector to CSE, click the +Add Field link, and add a field whose name is
_siemForwardand value is true.
- Event Format. Select Collect using JSON format.
- Windows Event Types. Select the desired event types. You can also specify Custom Event Channels in the box below.
- Event Collection Level. Select Concise Message.
- Security Identifier. You may specify how you want the Security Identifier (SID) to appear in the log message, Username Only is the default option.
- Collection should begin. Specify when you want the log collection to start.
- Click Save.
Step 2: Configure CSE Ingest Mapping
In this step, you configure a Sumo Logic Ingest Mapping in CSE for the source category assigned to your source or collector you configured in Step 1. The mapping tells CSE the information it needs to select the right mapper to process messages that have been tagged with that source category.
- Click the gear icon, and select Sumo Logic under Integrations.
- On the Sumo Logic Ingest Mappings page, click Create.
- On the Create Sumo Logic Mapping popup:
- Source Category. Enter the category you assigned to the HTTP Source or Hosted Collector in Step 1.
- Format. Enter
- Vendor. Enter
- Product. Enter
- Event ID.
- Click Create to save the mapping.
Step 3: Verify ingestion
In this step, you verify that your logs are successfully making it into CSE.
- Click the gear icon, and select Log Mappings under Incoming Data.
- On the Log Mappings page search for "Windows" and check under Record Volume.
- For a more granular look at the incoming records, you can also use search the Sumo Logic platform for Windows security records.