Windows Event Logs (Beta)

Stream Windows Event Logs directly to Panther over HTTPS

Overview

Windows Event Logs ingestion is in open beta starting with Panther version 1.75, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.

Panther supports ingesting Windows Event Logs through an HTTP Source, after they are forwarded with Fluent Bit.

How to onboard Windows Event Logs to Panther

Step 1: Create a new Windows Event Logs source in Panther

In the left-side navigation bar of your Panther Console, click Configure > Log Sources.
Click Create New.
Search for “Windows Event Logs,” then click its tile.
- In the slide-out panel, the Transport Mechanism dropdown in the upper-right corner will be pre-populated with the HTTP option.
Click Start Setup.
Follow Panther's instructions for configuring an HTTP Source, beginning at Step 5.
- When setting the Stream Type for the source, we recommend choosing JSON, as it corresponds to Format json_lines in the Fluent Bit configuration in the next step.
- When setting the Auth method for the source, we recommend using Shared Secret.

After creating the HTTP source, the Panther Console will display your HTTP Source URL. Store this value in a secure location, as you will need it in the next steps.

Step 2: Configure Fluent Bit in Windows

Follow the Getting Started with Fluent Bit instructions to install Fluent Bit as a service.
Create a Fluent Bit configuration file. See the examples below for instructions on configuring System and Security log streaming or Sysmon log streaming.
- You must use winevtlog. Other modules are deprecated and will not work.
- If you are using Windows Server 2012, Use_ANSI True may be required.
- If in Step 1 you chose JSON as your HTTP Source's Stream Type, in the OUTPUT section, provide Format a value of json_lines.
Start Fluent Bit, passing the path to your new config file.
- To run Fluent Bit as a Daemon every time the machine starts, follow the Windows Service instructions.

Fluent Bit configuration file examples

Ingest System and Security Logs

Configure the following in your Fluent Bit configuration file:

[INPUT] variables:
- Channels: Set this to System,Security
[OUTPUT] variables:
- Host: Enter your Panther URL.
  - Example: logs.instance-name.runpanther.net
- URI: Enter the end of the HTTP Source ingest URL (generated in Step 1 of this process), starting with /http/.
  - Example: /http/cb015ee4-543c-4489-9f4b-testaa16d7a
- Header: Enter the header name you created and the secret you generated while configuring your HTTP source in the Panther Console in Step 1.
- Name: Set to http.
- TLS: Set to ON.
- Port: Set to 443.

[SERVICE]
    Flush 5
    Daemon off
    Log_Level info

[INPUT]
    Name         winevtlog
    Channels     System,Security
    Interval_Sec 1
    DB           winevtlog.sqlite

[OUTPUT]
    Name         http
    Match        *
    Host         logs.instance-name.runpanther.net
    Port         443
    URI          /http/cb015ee4-543c-4489-9f4b-testaa16d7a
    Header       x-sender-header {YOUR_SECRET_HERE}
    Format       json_lines
    TLS          On
    TLS.Verify   On

Ingest Sysmon Logs

Configure sysmon.exe following the guide by SwiftOnSecurity.
- This process will create Windows Event Logs which Fluent Bit will ship to Panther.
Configure the following in your Fluent Bit configuration file:
- [INPUT] variables:
  - Channels: Set this to Microsoft-Windows-Sysmon/Operational
- [OUTPUT] variables:
  - Host: Enter your Panther URL.
    Example: logs.instance-name.runpanther.net
  - URI: Enter the end of the HTTP Source ingest URL (generated in Step 1 of this process), starting with /http/.
    Example: /http/cb015ee4-543c-4489-9f4b-testaa16d7a
  - Header: Enter the header name you created and the secret you generated while configuring your HTTP source in the Panther Console in Step 1.
  - Name: Set to http.
  - TLS: Set to ON.
  - Port: Set to 443.

[SERVICE]
    Flush 5
    Daemon on
    Log_Level info

[INPUT]
    Name         winevtlog
    Channels     Microsoft-Windows-Sysmon/Operational
    Interval_Sec 1
    DB           winevtlog.sqlite

[OUTPUT]
    Name         http
    Match        *
    Host         logs.instance-name.runpanther.net
    Port         443
    URI          /http/cb015ee4-543c-4489-9f4b-testaa16d7a
    Header       x-sender-header {YOUR_SECRET_HERE}
    Format       json_lines
    TLS          On
    TLS.Verify   On

Supported log types

Required fields in the schema are listed as "required: true"