We are providing you with the steps to integrate your Window MS Exchange with Seceon SIEM so One can have Comprehensive visibility and Proactive Threat Detection in your Environment. There will be a log transfer between your firewall to APE(Analytics and Policy Engine) via CCE (Collection and Control Engine ). In this document, we are guiding you through the steps for Log forwarding.
1.Login on MS Exchange server
Download the latest version of nxlog. It is easiest to choose the Windows msi file which includes an installer.
http://nxlog.org/products/nxlog-community-edition/download
2.Open the Nxlog configuration file at:
C:\Program Files\nxlog\conf\nxlog.conf ( Make sure you stick to the path mentioned).
(Replace the entire configuration file by pasting the following Below – Note to replace the variable ({IP address of Seceon Server}) with the actual Seceon Server IP address:)
## This is a sample configuration file. See the nxlog reference manual about the
## configuration options. It should be installed locally and is also available
## online at http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html
## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.
#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
<Extension syslog>
Module xm_syslog
</Extension>
define BASEDIR C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking
<Input in_exchange>
Module im_file
File '%BASEDIR%\MSGTRK*-*.LOG'
SavePos TRUE
Exec if $raw_event =~ /HealthMailbox/ drop();
Exec if $raw_event =~ /^#/ drop();
</Input>
<Output out_exchange>
Module om_udp
Host <CCE_IP_ADDRESS> (Put actual CCE IP)
Port 514
Exec $SyslogFacilityValue = 2;
Exec $SourceName = 'exchange_msgtrk_log';
Exec to_syslog_bsd();
</Output>
<Route 1>
Path in_exchange => out_exchange
</Route>
Open Services (from the search box on your windows) and restart nxlog from the list of services. If you do not find this service, type the following commands at an elevated (as an administrator) command prompt:
net stop nxlog
net start nxlog
Click on: NXlog
Click on :
Stop
Click on :
start
Login to UI.
To verify the configuration dropdown "Dashboard "
Go inside "Email Dashboard"
On successful configuration the email dashboard will reflect the count, if not , then refreshing the page and changing duration might help .
