Microsoft Windows Active Directory Context

About The Device

When we review an event log, we have a lot of information available to us about the action that was taken on an asset, no matter if the log source is an endpoint, network or authentication event, to name just a few.

Device Information

Entity	Particulars
Vendor Name	Microsoft
Product Name	Windows Active Directory
Type of Device	Hosted

Collection Method

Log Type	Ingestion label	Preferred Logging Protocol	Log collection method
Microsoft AD	WINDOWS_AD	JSON	CyberHub

Port Requirements

Source	Destination	Port
Windows AD	CyberHub	6514 (TLS)

Device Configuration

Pre-requisite:

Obtain the CyberHub Certificate by contacting the Accenture Onboarding Team.

Configuring the Windows Server

Configure all systems with the UTC time zone.
Create and set up a Powershell script to gather log data and store it in an output file on each Microsoft Windows Active Directory server.

Create a file with the ps1 extension and paste the below code.

 # Set the location where the log file will be written
$OUTPUT_FILENAME="<Path_of_the_output_file>"

If (Test-Path -Path $OUTPUT_FILENAME) { Remove-Item -path $OUTPUT_FILENAME -ErrorAction SilentlyContinue}

# USER_CONTEXT: Gets all Active Directory users and their properties.
Get-ADUser -Filter * -properties samAccountName | % { Get-ADUser $_.SamAccountName -properties * | ConvertTo-JSON -compress | Out-File -encoding utf8 $OUTPUT_FILENAME -Append }

# ASSET_CONTEXT: Gets all Active Directory assets and their properties.
Get-ADComputer -Filter * -properties samAccountName | % { Get-ADComputer $_.SamAccountName -properties * | ConvertTo-JSON -compress | Out-File -encoding utf8 $OUTPUT_FILENAME -Append }

Notes : See the following example. Change the value of $OUTPUT_FILENAME to the location where the output file should be written. This file will be read by NXLog. Data must be stored in JSON format. Set encoding to utf8. Use the -Filter parameter, rather than the -LDAPFilter parameter when calling the Get-ADUser and Get-ADComputer cmdlets.

Create a recurring task that runs the script to fetch and write data to the output file.
Open the Task Scheduler application.
Click on "Create task" on the right panel.
Enter the Name and Description for the task.
Select the "Run with highest privileges" checkbox to make sure all data is retrieved.

In the "Triggers" tab, define when you want to repeat the task.

In the "Action" tab, add a new action and provide the path of the file where the script is stored.

Configuring the NXLog Agent for log forwarding

Download and install the NXLog agent from the following location: https://nxlog.co/products/nxlog-community-edition/download.
Navigate to services.msc and stop the nxlog service.
Go to the folder "C:\Program Files\nxlog\data" and delete the file "configcache.dat" if it present.
Navigate to the installed location "C:\Program Files\nxlog\conf." Rename the attached file to "nxlog.conf" and copy it into this folder.
Replace the placeholder "CyberHub IP" with the actual CyberHub IP in the nxlog.conf file.
Replace the placeholder "output_file_location" with the actual full path of the Powershell script output file in the nxlog.conf file.
Copy the previously created certificate on Windows machine where nxlog agent is installed and mentioned this cert path in nxlog.conf against "CAFile" on line number 52.
Now, start the nxlog service from services.msc.
NXLog agent logs will be available at the location "C:\Program Files\nxlog\data\nxlog.log".
The log flow should work, and you can check it using tcpdump with the command "tcpdump --AA port 10014"

Integration Parameters

Parameters required from customer for Integration.

Property	Default Value	Description
IP Address	Windows AD IP address	Hostname or IP address of the device which forwards logs to the CyberHub.