...
Log Type | Ingestion label | Preferred Logging Protocol - Format | Log collection method |
|---|---|---|---|
Windows DNS | WINDOWS_DNS | Syslog | CyberHub |
...
Source | Destination | Port |
|---|---|---|
Microsoft Windows DNS | CyberHub | 10014 (TLS) |
To facilitate secure communication and align with our best practice, we strongly encourage the use of Transport Layer Security (TLS) between your security devices and our Adaptive MxDR platform for event forwarding.
While we understand that TLS support may not be available on all devices, if your devices do support TLS communication, we recommend utilizing port 10014 for seamless integration.
In some cases, the upgraded version of the device might incorporate TLS support without prior notice. If you come across such a scenario or for further assistance in configuring TLS, we kindly ask you to reach out to your dedicated Adaptive MxDR Service Delivery Lead.
Device Configuration
Note: Chronicle supports the Regional [English United States] M M/d/yyyy h:mm:ss tt date format which is recommended format by Windows. This change won't impact on the device timezone , it is just a date format change. So, make sure device date format is set to [English United States] M M/d/yyyy h:mm:ss tt before configuring device for log collection.
...
Click Debug Logging.
Select Log Packets for debugging.
In the Log file, type the file path and name, and the Maximum size.
Click Apply and OK.
Log Forwarding:
Steps to To configure Windows NxLog Agent for TLS TCP Log flow on port 10014:
...