Domain Controller security logs
Hello - I am testing out cribl stream/edge - first time user. Using version 4.1.2.
I've deployed a stream server, a single worker and a Edge node leader.
I've installed the edge node agents using the "Add/Update Edge Node" automated script.
I've done this on 5 servers in my environment to test how this would work. So far, I can see logs coming into Edge/Stream and into my siem with one exception. My domain controller is not capturing/sending any data. I have followed this: as my guide for the setup. The other 4 servers are working as expected but the domain controller is not.
I dug and found at the end of an article which states to check permissions on a registry key and make sure it has read rights; I checked that and still no data. I have checked the logs found under programdata\cribl\ and nothing jumps out.
- cribl is now accounting for 40GBs of space on that dc in the span of 3 days; what is causing the folder to grow?
- what other steps are needed to get the event logs (specifically security logs) to flow? when I look at the "destination" —> cribl_tcp —> status - there is never any events in buffer, sent bytes etc
Answers
-
Wondering if you tried capturing events at the source (Windows Event Log) on that domain controller to see if something is wrong. You can teleport and capture as well.
0 -
This is fairly new to me so not sure what teleporting means. If its where you can dive into the device from cribl edge from list view, then yes I have done that and I still see no data there. Suspecting it may be a permissions issue, I ran the Cribl edge service with an all god account for testing and still nothing - so there must be some additional config for DCs that I am not seeing.
0 -
Not sure if this helps, but I found a few articles on the web. May be Edge user needs permissions to access this log ?
0 -
Hi @Wesley Raynor,
- Have you opened a support case?
- When you say "isn't collecting data", what data are you referring to? Which logging channels? Which files?
- Do you see the Edge Node connected to the Leader in the list of Nodes?
- Do you have PQ enabled?
0 -
That was the first thing I checked. Thanks for the suggestion.
0 -
- No - I am trying cribl out, they referred me to the community hence my current question
- the data being referred to: Application/System/Security logs
- Yes - its connected
- No- since I am just doing a poc I did not invest the time in getting that in place as I may not end up using this. - This could possibly account for the growth in files under the cribl folder….which I do not recall setting up.
Thanks for the response.
0
