Micro Focus ArcSight Logger

include_stdout     C:\Program Files\nxlog\conf\windows-os-version.cmd

<Extension cef>
    Module         xm_cef
</Extension>

<Input eventlog>
    Module         im_msvistalog
    <QueryXML>
        <QueryList>
            <Query Id='0'>
                <Select Path='Application'>*</Select>
                <Select Path='Security'>*</Select>
                <Select Path='System'>*</Select>
            </Query>
        </QueryList>
    </QueryXML>
    <Exec>
      $CEFDeviceVendor = "Microsoft";
      $CEFDeviceProduct = "Microsoft Windows";

      # This value is obtained through executing a command file.
      # See the include_stdout directive above.
      $CEFDeviceVersion = '%OSNAME%';

      # This is required for some of the included searches in
      # ArcSight Logger to work.
      $CEFSignatureID = $SourceName+":"+$EventID;

      to_cef();
    </Exec>
</Input>

<Output arcsight_logger>
    Module         om_tcp
    Host           <arcsight_logger_ip>:6514
</Output>

@( Set "_= (
REM " ) <#
)
@Echo Off
SetLocal EnableExtensions DisableDelayedExpansion
set powershell=powershell.exe

REM Use this if you need 64-bit PowerShell (has no effect on 32-bit systems).
REM if defined PROCESSOR_ARCHITEW6432 (
REM set powershell=%SystemRoot%\SysNative\WindowsPowerShell\v1.0\powershell.exe
REM )

REM Use this if you need 32-bit PowerShell.
REM if NOT %PROCESSOR_ARCHITECTURE% == x86 (
REM set powershell=%SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
REM )

%powershell% -ExecutionPolicy Bypass -NoProfile ^
-Command "iex ((gc '%~f0') -join [char]10)"
EndLocal & Exit /B %ErrorLevel%
#>

# PowerShell code starts here.

# To make NXLog return an error, write to standard error and exit 1
if ($false) {
    [Console]::Error.WriteLine("This is an error")
    exit 1
}
else {
# Anything written to standard output is used as configuration content
	$osname = (Get-WmiObject -Class Win32_OperatingSystem).caption
	Write-Output "define OSNAME $osname"
}

CEF:0|Microsoft|Microsoft Windows|Microsoft Windows Server 2016 Standard|SceCli:1704|-|7|rt=1611907510135 dvchost=WIN2016.example.com Keywords=36028797018963968 outcome=INFO SeverityValue=2 Severity=INFO externalId=1704 SourceName=SceCli TaskValue=0 RecordNumber=1217 ExecutionProcessID=0 ExecutionThreadID=0 deviceFacility=Application msg=Security policy in the Group policy objects has been applied successfully. rt=1632145308412 SourceModuleName=eventlog SourceModuleType=im_msvistalog

include_stdout     /opt/nxlog/etc/linux-os-version.sh

<Extension syslog>
    Module         xm_syslog
</Extension>

<Extension cef>
    Module         xm_cef
</Extension>

<Input auth>
    Module         im_file
    File           '/var/log/auth.log'
    <Exec>
        if not defined ($Hostname)
        {
             $Hostname = hostname();
        }
        $ipaddress = host_ip();
    </Exec>
</Input>

<Input messages>
    Module         im_file
    File           '/var/log/messages'
    Exec           $ipaddress = host_ip();
</Input>

<Output arcsight_logger>
    Module         om_tcp
    Host           <arcsight_logger_ip>:6514
    <Exec>
        parse_syslog();

        # Changing this to Linux helps us better identify Linux
        # events instead of searching for specific events.
        $CEFDeviceVendor = "Linux";

        # This value is obtained through executing a shell script.
        # See the include_stdout directive above.
        $CEFDeviceVersion = '%OSNAME%';
        
        to_cef();
    </Exec>
</Output>

#!/bin/bash
OSHOST=$(cat /etc/os-release | grep -oP '^NAME=.*' | grep -oP '"(.*)"' | sed s/\"//g)
OSVERSION=$(cat /etc/os-release | grep VERSION= | grep -oP '"(.*)"' | sed s/\"//g)
OSNAME="$OSHOST $OSVERSION"
echo "define OSNAME $OSNAME"

CEF:0|Linux|NXLog|Ubuntu 20.04.2 LTS (Focal Fossa)|0|-|7|rt=1631698896137 SourceModuleName=messages SourceModuleType=im_file ipaddress=192.168.0.103 SyslogFacilityValue=1 SyslogFacility=USER SyslogSeverityValue=5 SyslogSeverity=NOTICE SeverityValue=2 Severity=INFO dvchost=NXLog-Ubuntu-1 rt=1631698896000 SourceName=systemd ProcessID=1 msg=Started NXLog daemon.