Cant Get Windows Event Logs in SecOnion / Kibana

[hann-cyber]

Version

2.4.3

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Eval

Location

other (please provide detail below)

Hardware Specs

Exceeds minimum requirements

CPU

4

RAM

16

Storage for /

200 GB

Storage for /nsm

200 GB

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi, I've been troubleshooting various issues trying to get my environment setup the way I need it to work and thought I'd try here for some assistance.

Objective: Have SecOnion running on a virtual network with 2 windows server 2022 domain controllers. There's an ubuntu analyst machine, as well. Windows event logs need to be sent to SecOnion with Sysmon / WinlogBeat, and have them viewable in Kibana.

Issue: Everyone can connect to the web interface but Syslog / windows event logs not showing up.
For simplicity, I reset my network and don't plan to have 2nd DC or Ubuntu Analyst w/ static IP for the web interface until I get the windows events viewable in Kibana.

Steps I've taken:

1. VirtualBox setup with a NAT network + Host-Only Network on all machines.
2. SecOnion is monitoring host-only network, and the web interface is accessible to all machines on NAT network until I get some logs functioning correctly. I was tired of switching to the Ubuntu machine to check Kibana while working on Windows Server.
3. Windows Server has static IP, and I added the machine to Elastic fleet. I also installed sysmon with SwiftOnSecurity github config file.
4. I installed WinLogBeat and pointed "setup.kibana" host and "output.elasticsearch" host to SecOnion's IP in the config file. Started service.
5. When I got to SecOnion webinterface > Kibana Dashboard > I ran a search for client.ip:"windowsServerStaticIP" All I see are zeek.dns and zeek.conn data sets.
6. SecOnion's dashboard shows a bunch of missing info:

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[cm-ops]

Since you are on 2.4, you need to use the Elastic Agent from Downloads to bring in Windows logs. https://docs.securityonion.net/en/2.4/elastic-agent.html#

[hann-cyber]

Upon reading the guide, I did a fresh Stand alone install of SecOnion since I originally did the Eval.

Resulted in the same issue after installing the agent and allowing through firewall. Fresh installs of Windows Server 22 as well, after creating a domain. Is there perhaps a Windows policy I need to activate or something else?

I also added windows integration and that's working fine, just nothing other than zeek found in Kibana searches. Dashboard shows missing system.syslog.

[cm-ops]

The endpoints initial policy will have the following integrations:

Where did you get the installer for EA from? Did you download from SOC > Downloads?