Import Windows system log data-Security Center(Security Center)-阿里云帮助中心

You can import Windows system logs — such as Windows AD DNS logs and Windows Event logs — into Agentic SOC for security analysis. To set up the data pipeline, create a Windows system log data source in the Security Center console, and then configure the LoongCollector collection component in the Simple Log Service (SLS) console. After the configuration is complete, Windows system logs are automatically collected and synchronized to Agentic SOC.

Import process

This solution involves creating a data source in Agentic SOC, configuring an Alibaba Cloud Simple Log Service (SLS) Logstore to receive Windows system logs, and then configuring a LoongCollector collection task to continuously collect Windows system logs into the Logstore. After you verify that data is collected correctly, you enable the product access policy for continuous log collection. The configuration process is as follows:

Create a data source

This section describes how to create data sources for Windows AD DNS logs and Windows Event logs.

Create a Windows AD DNS log data source

Create a dedicated Agentic SOC data source for Windows AD DNS log data.

Access the Security Center console - Agentic SOC - Management - Access Settings. In the upper-left corner of the page, select the region where the assets to be protected are located: Chinese Mainland or Outside Chinese Mainland.
Click the Data Source tab. In the search box next to Data Source Name, search for Windows AD DNS logs.

Find the Windows AD DNS log entry and click Edit on the right side. Click Create Instance, select or create a Logstore to receive the log data synchronized from Windows AD DNS. In this example, a Logstore named windows_ad_dns_log is created. Click OK.

After the data source is configured, record the region, project, and Logstore information of the new instance. This information is required in subsequent steps.

Create a Windows Event logs data source

Create a dedicated Agentic SOC data source for Windows Event log data.

Access the Security Center console - Agentic SOC - Management - Access Settings. In the upper-left corner of the page, select the region where the assets to be protected are located: Chinese Mainland or Outside Chinese Mainland.
Click the Data Source tab. In the search box next to Data Source Name, search for Windows Event logs.

Find the Windows Event logs entry and click Edit on the right side. Click Create Instance, select or create a Logstore to receive the log data synchronized from Windows Event logs. In this example, a Logstore named windows_security_event_log is created. Click OK.

After the data source is configured, record the region, project, and Logstore information of the new instance. This information is required in subsequent steps.

Configure log collection with LoongCollector

In the SLS console, find the Logstore that corresponds to the instance you created, and configure LoongCollector to collect logs from the corresponding Windows machine. For more information, see Use LoongCollector to collect Windows event logs.

Log on to SLS console. Filter by the region and project noted previously to find the corresponding project.

Click the target project to open the project details page. Find the corresponding Logstore and click its Logtail configuration.

If you are configuring Windows AD DNS log collection, search for the Logstore windows_ad_dns_log.
If you are configuring Windows Event log collection, search for the Logstore windows_security_event_log.

On the Logtail configuration details page, click Add Logtail Configuration. In the dialog box that appears, select Windows Event Logs and click Integrate Now.
In the Create Machine Group section, select Self-managed Machine and follow the Windows installation instructions to install LoongCollector.
After the installation is complete, click Complete Installation.
In the next step, enter the Name and IP Address, and optionally configure other settings based on your requirements. Click Next.

On the machine group configuration page, the machine group created in the previous step is selected by default. Click Next. The machine group heartbeat status is displayed at the bottom of the page. Make sure that the heartbeat status of all machines in the machine group is OK. If the status is not OK, LoongCollector was not installed correctly on the machine. After you confirm the status, click Next.

On the Configure Data Source page, modify the plug-in configuration.

If you are configuring Windows AD DNS log collection, modify the plug-in configuration to the following (you can modify the DNSQueryDomainFilters as needed to filter out domains that you do not want to collect):

{
  "inputs": [
    {
      "type": "service_etw",
      "detail": {
        "ProviderName": "Microsoft-Windows-DNSServer",
        "Level": 4,
        "Keywords": "0x8000000000000037",
        "BufferSizeKB": 128,
        "MinBuffers": 8,
        "MaxBuffers": 64,
        "FlushTimerSec": 1,
        "EventQueueSize": 16384,
        "DropWhenQueueFull": true,
        "AsyncProcess": true,
        "WorkerCount": 4,
        "ParsePacketData": true,
        "DNSQueryDomainFilters": [
          "*.azure.cn",
          "*.azure-automation.cn"
        ]
      }
    }
  ]
}

If you are configuring Windows Event log collection, modify the plug-in configuration to the following :

{
  "inputs": [
    {
      "type": "service_wineventlog",
      "detail": {
        "Name": "Security",
        "IgnoreOlder": 259200
      }
    },
    {
      "type": "service_wineventlog",
      "detail": {
        "Name": "System",
        "IgnoreOlder": 259200
      }
    }
  ]
}

After you modify the configuration, click Next to proceed to Query and Analysis Configurations. If you have no special requirements, use the default configuration and click Next to complete the configuration.

Verify collected data

Access the Security Center console - Agentic SOC - Management - Access Settings. In the upper-left corner of the page, select the region where the assets to be protected are located: Chinese Mainland or Outside Chinese Mainland.
Click the Data Source tab. In the search box next to Data Source Name, search for the corresponding data source name.

If you are importing Windows AD DNS logs, search for: Windows AD DNS logs.
If you are importing Windows Event logs, search for: Windows Event logs.

In the Actions column, click Preview. If data is displayed, the Windows system log collection is configured successfully.

Enable product access policy

Access the Security Center console - Agentic SOC - Management - Access Settings. In the upper-left corner of the page, select the region where the assets to be protected are located: Chinese Mainland or Outside Chinese Mainland.
Click the Service Integration tab. In the product search box, search for Windows Terminal.

In the Actions column, click Ingestion Settings. On the page that appears, find the corresponding data source entry and turn on the Enabling Status switch on the right side.

If you are importing Windows Event logs, enable the corresponding data source: Windows Event logs.
If you are importing Windows AD DNS logs, enable the corresponding data source: Windows AD DNS logs.