Windows Event Logs (Beta)
Stream Windows Event Logs directly to Panther over HTTPS
Overview
Windows Event Logs ingestion is in open beta starting with Panther version 1.75, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.
Panther supports ingesting Windows Event Logs through an HTTP Source, after they are forwarded with Fluent Bit.
How to onboard Windows Event Logs to Panther
Step 1: Create a new Windows Event Logs source in Panther
In the left-side navigation bar of your Panther Console, click Configure > Log Sources.
Click Create New.
Search for “Windows Event Logs,” then click its tile.
In the slide-out panel, the Transport Mechanism dropdown in the upper-right corner will be pre-populated with the HTTP option.
Follow Panther's instructions for configuring an HTTP Source, beginning at Step 5.
When setting the Auth method for the source, we recommend using Shared Secret.
Payloads sent to this source are subject to the payload requirements for all HTTP sources.
After creating the HTTP source, the Panther Console will display your HTTP Source URL. Store this value in a secure location, as you will need it in the next steps.
Step 2: Configure Fluent Bit in Windows
Follow the Getting Started with Fluent Bit instructions to install Fluent Bit as a service.
Create a Fluent Bit configuration file. See the examples below for instructions on configuring System and Security log streaming or Sysmon log streaming.
You must use
winevtlog
. Other modules are deprecated and will not work.If you are using Windows Server 2012,
Use_ANSI True
may be required.If in Step 1 you chose JSON as your HTTP Source's Stream Type, in the
OUTPUT
section, provideFormat
a value ofjson_lines
.
Start Fluent Bit, passing the path to your new config file.
To run Fluent Bit as a Daemon every time the machine starts, follow the Windows Service instructions.
Fluent Bit configuration file examples
Ingest System and Security Logs
Configure the following in your Fluent Bit configuration file:
[INPUT]
variables:Channels: Set this to
System,Security
[OUTPUT]
variables:Host: Enter your Panther URL.
Example:
logs.instance-name.runpanther.net
URI: Enter the end of the HTTP Source ingest URL (generated in Step 1 of this process), starting with
/http/
.Example:
/http/cb015ee4-543c-4489-9f4b-testaa16d7a
Header: Enter the header name you created and the secret you generated while configuring your HTTP source in the Panther Console in Step 1.
Name: Set to
http
.TLS: Set to
ON
.Port: Set to
443
.
Supported log types
Windows.EventLogs
Last updated