Centralised Logs Collection / Analysis

[psynegy]

Hello everyone!

 

We're looking at implementing some sort of centralised logging on our Windows network.

 

A few things we're aware of that might be solutions:

• Windows Event Collector
  
• LME (now deprecated)
  
• Azure Sentinel
  

 

I suppose there's two 'problems' we're trying to solve:

1. Enabling us to rapidly find out what happened in the event of a cyber attack.
   
2. Analysis of the network health and picking up on issues before they become tickets.
   

 

Would be very interested to hear what other people are using, what benefits they are seeing from them, and what some realistic costs should be.

 

Any pointers are most appreciated! Thanks!

[psydii]

I should stand up sentinel (which with E5 has a 'free' tier) https://azure.microsoft.com/en-us/pricing/offers/sentinel-microsoft-365-offer/

 

...but mostly we rely on Defender e5, Azure ATP (defender for identity) and MCAS (Defender for Cloud Apps)

[psynegy]

I should stand up sentinel (which with E5 has a 'free' tier) https://azure.microsoft.com/en-us/pricing/offers/sentinel-microsoft-365-offer/

...but mostly we rely on Defender e5, Azure ATP (defender for identity) and MCAS (Defender for Cloud Apps)

We only have two A5 accounts... I think it was a big cost jump from A3 for staff, not sure about students.

 

Do you have E5 for everyone?

[psydii]

Do you have E5 for everyone?

We do.

[kevin_lane]

Hello everyone!

 

We're looking at implementing some sort of centralised logging on our Windows network.

 

A few things we're aware of that might be solutions:

• Windows Event Collector
  
• LME (now deprecated)
  
• Azure Sentinel
  

 

I suppose there's two 'problems' we're trying to solve:

1. Enabling us to rapidly find out what happened in the event of a cyber attack.
   
2. Analysis of the network health and picking up on issues before they become tickets.
   

 

Would be very interested to hear what other people are using, what benefits they are seeing from them, and what some realistic costs should be.

 

Any pointers are most appreciated! Thanks!

 

Yea we tried to use LME with the use of slack ? I think it was.. the ncsc had a guide which was ok but just flaky and very overwhelming of information with no real way structure of the data, not very easily anyway, I’d be quite interested of other peoples views and setups on this topic

 

Thanks

[localzuk]

I have set up a Graylog server here, with an OpenSearch server behind it, and then have Beats winlogbeat sending logs from a couple of servers, plus a syslog input to get some data from our firewall etc...

 

Early days at the moment. Its a complicated system with total flexibility in what it does.

 

At some point I'll sit down and set up some alerts - there's a plugin for Teams, so we could theoretically get it to post alert notifications there.

[RobD]

I've used splunk in the past and it was brilliant but not cheap.

[MatthewL]

Have a look at UTMStack, the free version will do up to 90 days log collection and is apparently easier to configure than Splunk.

[dmj]

I've used an opensource syslog server for windows logging in the past, worked well.

I think these days I would recommend using the ELK stack for this, as there is more visibility/gui. It is also free and opensource, but there is a paid hosted option if you want (we use this option)

https://www.elastic.co/blog/elasticsearch-free-open-limitless

[stevewill6]

I set up windows event forwarding for applocker logs to be sent to my log server - worked well untill deploying windows 11, the gpo caused explorer to hang, never got to the bottom of it.

[pete]

*waves the Wazuh flag again*

 

https://wazuh.com

 

ELK stack (using Amazon's Elastic stack, which suffers less from dependency hell).

 

A ~1000 user secondary (with GPOs configuring event logs to log odd stuff) should probably assign 200GB of space for six months retention (all servers logging to Wazuh).

[RobD]

Forgot to mention VMware vRealize Log Insight, another paid tool but pretty good.