#logcollection β Public Fediverse posts
Live and recent posts from across the Fediverse tagged #logcollection, aggregated by home.social.
-
I'm currently toying with Cribl and in my experience so far, this is the easiest log collecting software I've ever used. It just works, has a good visibility on what it's actually doing with the data, git backed configuration and much more. Too bad it's a commercial product which is not really affordable for small organisations.
#cybersecurity #logcollection -
ππΌπ ππΌ π°πΌπΉπΉπ²π°π π°ππππΌπΊ π²ππ²π»π πππ ππΌ π πΆπ°πΏπΌππΌπ³π π¦π²π»ππΆπ»π²πΉ
Microsoft Sentinel is Microsoft's SIEM/SOAR. It is used to collect and evaluate logs.
If you choose to collect security logs from Windows Server, Microsoft Sentinel can collect predefined log sets using the built-in settings. By default, you have the option to select from the predefined sets All Security Events, Common, or Minimal.
However, if you need to collect some custom Event IDs that do not belong to the above built-in categories, or simply want your own set of Event IDs to collect, you can define your own Event IDs using XPath queries.
XPath (XML Path Language) is a query language used for selecting nodes from an XML document. It allows you to navigate through elements and attributes in XML documents, making it a powerful tool for extracting specific pieces of information. XPath is commonly used in combination with XML parsers to filter and locate data based on complex conditions.
Read my blog post bellow π π
https://www.cswrld.com/2025/06/how-to-collect-custom-event-ids-to-microsoft-sentinel/ -
Rapid7 has published a post on collecting audit logs from InsightVM with InsightIDR using NXLog Community Edition https://blog.rapid7.com/2019/10/30/be-audit-you-can-be-part-1-how-to-securely-send-and-monitor-your-audit-logs-with-insightidr/ β¦ #infosec #SIEM #logcollection
There is another part, which is on parsing.
-
Collecting Linux Ingress Authentication Events using Rapid7 Universal Event Formats
https://superuser-ltd.github.io/2019/IngressAuthentication-Linux/
Continuation of:
Collecting Windows Ingress Authentication Events using Rapid7 Universal Event Formats