{"type":"doc","content":[{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"text":"XPLG’s architecture allows receiving data sent by logstash, using XPLG's logstash output.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]},{"type":"paragraph","content":[{"text":"When using an advanced topology there can be multiple filebeat/winlogbeat forwarders which send data into a centralized logstash. The logstash input is the filebeat/winlogbeat forwarder(s) output. The logstash output is forwarded to XPLG Listener(s).","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]},{"type":"paragraph","content":[{"text":" There are options to push data over HTTP/S and in some cases over SysLog.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"text":"Topology:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]},{"type":"extension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"drawio","parameters":{"macroParams":{"baseUrl":{"value":"https://xpolog.atlassian.net/wiki"},"diagramName":{"value":"Topology.drawio"},"tempPreview":{"value":"Topology.png"},"width":{"value":"500"},"zoom":{"value":"1"},"custContentId":{"value":"1592983563"},"pageId":{"value":"1599143868"},"lbox":{"value":"1"},"contentVer":{"value":"1"},"height":{"value":"500"},"revision":{"value":"1"}},"macroMetadata":{"macroId":{"value":"4045b631-5df1-4be2-b1a8-0292324e3031"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"image","data":{"url":"https://ac.draw.io/connectImage?baseUrl=https%3A%2F%2Fxpolog.atlassian.net%2Fwiki&diagramName=Topology.drawio&tempPreview=Topology.png&width=500&zoom=1&custContentId=1592983563&pageId=1599143868&lbox=1&contentVer=1&height=500&revision=1"}}],"title":"draw.io Diagram"}}}},{"type":"paragraph","content":[{"text":"To set up a full forwarding system to XPLG there is a need to set a central Logstash forwarder in the same XPLG server and Filebeat forwarder on each machine (Windows/Mac/Linux/Docker). In case of a windows machine, forwarding Windows Events Logs requires a different forwarder - winlogbeat.","type":"text"}]},{"type":"paragraph","content":[{"text":"you may follow these footsteps:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Browse to XPLG and set an HTTP listener according to the guideline in the article: ","type":"text"},{"text":"HTTP/S","type":"text","marks":[{"type":"link","attrs":{"href":"https://xpolog.atlassian.net/wiki/spaces/XPOL/pages/1598685520"}}]},{"type":"hardBreak"},{"text":"Remarks: ","type":"text"},{"type":"hardBreak"},{"text":"Expand the advanced settings and","type":"text"},{"type":"hardBreak"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In cluster topology, set listening node to '","type":"text"},{"text":"ALL","type":"text","marks":[{"type":"strong"}]},{"text":"'","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Copy the listener URL for later use when setting the logstash","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set split by Source Device to '","type":"text"},{"text":"Create log by unique IP / host name","type":"text","marks":[{"type":"strong"}]},{"text":"'","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set JSON Parsing Level to 1","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Once saving the configuration verify that the listener status is '","type":"text"},{"text":"Running","type":"text","marks":[{"type":"strong"}]},{"text":"'. If needed start it","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Prepare relevant templates for the log patterns in XPLG:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For Windows Events Logs it is mandatory that you import the following templates: ","type":"text"},{"text":"Windows-Events-Templates.zip","type":"text","marks":[{"type":"link","attrs":{"href":"https://xpolog.atlassian.net/wiki/download/attachments/1599143868/Windows-Events-Templates.zip?version=1&modificationDate=1547133092272&cacheVersion=1&api=v2"}}]},{"text":". To import the templates to XPLG enter XPLG Manager> Left Navigation Panel> Data> Patterns> Import Template > Choose the file & press Next.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For other Logs - it is suggested that you prepare templates in advance but it is not mandatory (template name is case sensitive and must match the name of the pattern set in the exported logs in Filebeat Forwarder(s)). ","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter the designated server for the logstash installation. It should be locally in the same server as XPLG is installed upon (In cluster mode consult with XPLG Support Team which node should it be installed upon). Then set the logstash according to guidelines described at the article ","type":"text"},{"text":"Setting Up a Logstash Forwarder","type":"text","marks":[{"type":"link","attrs":{"href":"https://xpolog.atlassian.net/wiki/spaces/XPOL/pages/1600094349"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set up filebeat forwarder(s) according to the guidelines described at the article ","type":"text"},{"text":"Setting Up a Filebeat Forwarder","type":"text","marks":[{"type":"link","attrs":{"href":"https://xpolog.atlassian.net/wiki/spaces/XPOL/pages/1600094353"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set up Winlogbeat forwarder(s) according to the guidelines described at the article","type":"text"},{"text":"Setting up Winlogbeat Frowarder","type":"text","marks":[{"type":"link","attrs":{"href":"https://xpolog.atlassian.net/wiki/spaces/XPOL/pages/1600094916"}}]},{"text":".","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Once all is set according to the guidelines enter XPLG> Folders and logs. All the forwarder logs should be created automatically under the Folders&Logs Tree according to the following topology:","type":"text"}]},{"type":"paragraph","content":[{"text":"FOLDERS&LOGS","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":2}}],"content":[{"text":"App-Logs","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":3}}],"content":[{"text":"","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":4}}],"content":[{"text":"Server-1 ","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":4}}],"content":[{"text":"Server-1 ","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":3}}],"content":[{"text":"","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":4}}],"content":[{"text":"Server-2 ","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":4}}],"content":[{"text":"Server-2 ","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":3}}],"content":[{"text":"","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":4}}],"content":[{"text":"Server-n ","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":4}}],"content":[{"text":"Server-n ","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":2}}],"content":[{"text":"Win-Events","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":3}}],"content":[{"text":"","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":4}}],"content":[{"text":"Server-1 Security","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":4}}],"content":[{"text":"Server-1 System","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":4}}],"content":[{"text":"Server-1 Application","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":3}}],"content":[{"text":"","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":4}}],"content":[{"text":"Server-2 Security","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":4}}],"content":[{"text":"Server-2 System","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":4}}],"content":[{"text":"Server-2 Application","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":3}}],"content":[{"text":"","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":4}}],"content":[{"text":"Server-n Security","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":4}}],"content":[{"text":"Server-n System","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":4}}],"content":[{"text":"Server-n Application","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":2}}],"content":[{"type":"hardBreak"}]}],"version":1}