{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"minLevel":{"value":"1"},"maxLevel":{"value":"7"}},"macroMetadata":{"macroId":{"value":"37ba7b5f7ff8d9300305483c14e18171"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"78a3ced2-f880-4f01-b00b-5b47f9b0782b"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"We are providing you with the steps to integrate your Microsoft SQL Server with Seceon SIEM so One can have Comprehensive visibility and Proactive Threat Detection in your Environment. There will be a log transfer between your firewall to APE(Analytics and Policy Engine) via CCE (Collection and Control Engine ). In this document, we are guiding you through the steps for forwarding logs.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Enabling Audit logs in the MSSQL server","type":"text"}]},{"type":"paragraph","content":[{"text":"Enable Audit logs in the MSSQL server with the steps below:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open Microsoft SQL Management Studio with the appropriate credentials. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In Object Explorer, right-click on the database server and select Properties.","type":"text"}]}]}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":50.0},"content":[{"type":"media","attrs":{"width":586,"id":"9e1ad123-0d08-46fc-a2a7-226c55d18642","collection":"contentId-1570799652","type":"file","height":812}}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Properties","type":"text","marks":[{"type":"textColor","attrs":{"color":"#0747a6"}},{"type":"strong"}]},{"text":" panel, select ","type":"text"},{"text":"Security","type":"text","marks":[{"type":"textColor","attrs":{"color":"#0747a6"}},{"type":"strong"}]},{"text":" ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#0747a6"}}]},{"text":"in the ","type":"text"},{"text":"Select a page","type":"text","marks":[{"type":"textColor","attrs":{"color":"#0747a6"}},{"type":"strong"}]},{"text":" section.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" In ","type":"text"},{"text":"Login auditing","type":"text","marks":[{"type":"textColor","attrs":{"color":"#0747a6"}},{"type":"strong"}]},{"text":", select Both failed and successful logins.","type":"text"}]}]}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":65.0},"content":[{"type":"media","attrs":{"width":1139,"id":"85b6585e-550d-4e42-b6e3-635df4286e95","collection":"contentId-1570799652","type":"file","height":972}}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Enabling server auditing","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open Microsoft SQL management studio with appropriate credentials. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In Object Explorer, expand the Security tab to view Audits and Server Audit Specifications options.","type":"text"}]}]}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":55.0},"content":[{"type":"media","attrs":{"width":630,"id":"688c09aa-a284-4402-aed5-77d9615b15ec","collection":"contentId-1570799652","type":"file","height":730}}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Creating Audits","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Right-click Audits to select New Audit..","type":"text"}]}]}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":55.0},"content":[{"type":"media","attrs":{"width":307,"id":"f954e151-2d3a-412f-b39c-557363e75dc7","collection":"contentId-1570799652","type":"file","height":190}}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In Audit Properties, provide the appropriate audit name and set the audit destination as the application log. The configured Audit properties pane is shown below:","type":"text"}]}]}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":65.0},"content":[{"type":"media","attrs":{"width":914,"id":"327a4504-c250-4857-b351-ede64f96e8e9","collection":"contentId-1570799652","type":"file","height":930}}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click OK to apply settings.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Creating Server Audit Specifications","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Right-click Server Audit Specifications and select New Server Audit Specification…","type":"text"}]}]}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":55.0},"content":[{"type":"media","attrs":{"width":459,"id":"1143d485-3b3b-4f16-bb1c-0b23972aee51","collection":"contentId-1570799652","type":"file","height":267}}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In Server Audit Specification Properties, provide an appropriate specification name and choose an earlier created audit name from the drop-down menu.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":" Configured Server Audit Specification Properties pane is shown below:","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":55.0},"content":[{"type":"media","attrs":{"width":853,"id":"aa85b4cb-9a8b-4eb8-80bb-c18b6d10d1d8","collection":"contentId-1570799652","type":"file","height":812}}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click OK to apply settings. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" Right-click on the earlier created audit and select Enable.","type":"text"}]}]}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":40.0},"content":[{"type":"media","attrs":{"width":303,"id":"b2f82c58-a993-4095-a907-772e309f6cd5","collection":"contentId-1570799652","type":"file","height":446}}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Right-click on the earlier created Server Audit Specification and select Enable Server Audit Specification.","type":"text"}]}]}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":50.0},"content":[{"type":"media","attrs":{"width":436,"id":"1b5020ff-5a54-4cc2-b1a0-e17ed327abce","collection":"contentId-1570799652","type":"file","height":406}}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To view audit logs, enable login auditing and click on the 'View Audit Logs' button.","type":"text"}]}]}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":55.0},"content":[{"type":"media","attrs":{"width":903,"id":"015845bd-7a88-4414-9d55-9c445f051bdb","collection":"contentId-1570799652","type":"file","height":680}}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The outcome will show login success.","type":"text"}]}]}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":65.0},"content":[{"type":"media","attrs":{"width":1807,"id":"66bda459-518e-4d62-84ea-64f03d57533f","collection":"contentId-1570799652","type":"file","height":907}}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"NxLog Configuration","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Login on the Windows SQL Server with administrator rights.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Download the latest version of nxlog. It is easiest to choose the Windows MSI file which includes an installer. Use the link:","type":"text"},{"text":" ","type":"text","marks":[{"type":"strong"}]},{"type":"inlineCard","attrs":{"url":"https://nxlog.co/downloads/nxlog-ce#nxlog-community-edition"}},{"text":" ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the Nxlog configuration file at: ","type":"text"},{"text":"C:\\Program Files (x86)\\nxlog\\conf\\nxlog.conf","type":"text","marks":[{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Replace the entire configuration file by pasting the following Below – Note to replace the variable ","type":"text"},{"text":"(","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]},{"text":"IP Address of Seceon Collector","type":"text","marks":[{"type":"code"}]},{"text":")","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]},{"text":" with the actual Seceon Server IP address:","type":"text"}]}]}]},{"type":"codeBlock","content":[{"text":"## This is a sample configuration file. See the nxlog reference manual about the\n## configuration options. It should be installed locally and is also available\n## online at http://nxlog.org/docs/\n## Please set the ROOT to the folder your nxlog was installed into,\n## otherwise it will not start.\ndefine ROOT C:\\Program Files\\nxlog\n\n#define ROOT C:\\Program Files (x86)\\nxlog\n#define ROOT C:\\Program Files (x86)\\nxlog\n\nModuledir %ROOT%\\modules\nCacheDir %ROOT%\\data\nPidfile %ROOT%\\data\\nxlog.pid\nSpoolDir %ROOT%\\data\nLogFile %ROOT%\\data\\nxlog.log\n\n \n Module xm_json\n\n\n#Extension for MSSQL\n\n Module xm_csv\n Fields $Hostname, $SourceName, $Action_ID, $Result, $DataBase, $SV_Instace, $User, $Message\n FieldTypes string, string, string, string, string, string, string, string\n Delimiter ;\n\n\n#Input for MSSQL\n\n Module im_msvistalog\n SavePos FALSE\n ReadFromLast TRUE\n Exec $Message = $raw_event;\n # Finding some values:\n Exec if $raw_event =~ /action_id:(\\S+)/ $Action_ID = $1;\n Exec if $raw_event =~ /database_name:(\\S+)/ $DataBase = $1;\n Exec if $raw_event =~ /server_instance_name:(\\S+)/ $SV_Instace = $1;\n Exec if $raw_event =~ /session_server_principal_name:(\\S+)/ $User = $1;\n Exec if $raw_event =~ /AUDIT_SUCCESS/\\\n {\\\n $Result = 'Success';\\\n }\\\n else\\\n $Result = 'Failure';\n # Replace white spaces\n Exec $Message = replace($Message, \"\\t\", \" \"); $Message = replace($Message, \"\\n\", \" \"); $Message = replace($Message, \"\\r\", \" \");\n\n\n#Output for MSSQL\n\n Module om_udp\n Host CCE_IP_ADDRESS\n Port 514\n # Ensure we send in the proper format:\n Exec $Hostname = hostname_fqdn();\n Exec mssql_csv->to_csv(); $raw_event = $Hostname + ' mssql_logs: ' + $raw_event;\n\n\n#Route for MSSQL Logs\n\n Path in_mssql => out_mssql\n\n","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Verification of configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"Verification of configuration can be done in two ways:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"From the Collector-Syslog Server (CCE): This can involve logging into the CCE and checking the configuration settings, testing the connectivity and functionality of the various components, and comparing the actual results against the expected or desired outcomes.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"From the UI: This can involve logging into the user interface and checking the configuration settings, monitoring the logs and flows, and comparing the actual results against the expected or desired outcomes.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Both methods can be used to ensure that the system is properly configured and working as intended.","type":"text"}]},{"type":"paragraph","content":[{"text":"Using UI","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"STEP 1:","type":"text","marks":[{"type":"strong"}]},{"text":"Log in to UI >> SYSTEM","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":30.0},"content":[{"type":"media","attrs":{"width":220,"id":"5b6a3759-3d7c-4cd0-bd4b-49c163699efe","collection":"contentId-1570799652","type":"file","height":300}}]},{"type":"paragraph","content":[{"text":"STEP 2:","type":"text","marks":[{"type":"strong"}]},{"text":" >> Logs and flows collection status","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":30.0},"content":[{"type":"media","attrs":{"width":227,"id":"b8b91dac-0dad-4399-8c13-1d196f12c1e3","collection":"contentId-1570799652","type":"file","height":163}}]},{"type":"paragraph","content":[{"text":"STEP 3: ","type":"text","marks":[{"type":"strong"}]},{"text":">>To verify the source device IP from the UI:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log in to the user interface","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Navigate to the \"SYSTEM\" section","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Look for the \"SOURCE DEVICE IP\"","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Check the IP address that is displayed","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Compare the IP address displayed against the expected source device IP","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"This will allow you to ensure that the system is properly identifying the source device IP and that it matches the expected IP address.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":75.0},"content":[{"type":"media","attrs":{"width":1469,"id":"f6a712dd-0b31-4cba-a669-393573933373","collection":"contentId-1570799652","type":"file","height":264}}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]},{"type":"paragraph"},{"type":"paragraph"},{"type":"paragraph"},{"type":"paragraph"},{"type":"paragraph"}],"version":1}