Domain Joined Windows Hosts - WEF
Deployment
This guide will provide high level organisational staging and operations for this deployment.
The advantages of this approach are:
- Only Microsoft software and underlying infrastructure is used up until final event extraction on the centralised WEC servers.
- Self-managed. No maintenance is required and new systems joining the domain automatically start forwarding events.
- Configured and deployed using Active Directory Group Policy.
WEC Servers used in this guide are the Windows hosts, domain joined which receive and store the forwarded events for a prescribed period or combined size.
A typical deployment involves the following stages:
- WEF Testing.
- WEC Server Deployment.
- Incremental WEF Enablement.
The implementation of a Windows Event Forwarding environment is detailed within the Standard Operating Procedure (SOP) documentation with supporting configuration files and automation in this location.
Deployment Topology
Centralised
Centralised HyperCollector WEF Deployment
A medium to small organisation or a large organisation with reliable, performant and affordable Wide Area Network (WAN) links should use a Centralised model, where all one or more WEC Servers are located in a centralised location.
Multi-Region
When deploying a WEF environment the location of the WEC servers, which receive the forwarded events, is important in Wide Area Network (WAN) bandwidth constrained or expensive environments. In these situations a deployment of WEF Server(s) + a local HyperCollector per-region is recommended.
WEF Testing
During this stage your infrastructure team will perform a dry-run your complete deployment to perform integration testing and increase familiarity. This is commonly performed for larger organisations with stringent change control processes and highly complex systems. Medium to small organisations can typically perform this step relatively quickly, if required at all.
Requirements to perform the first step are:
Step 1 - WEF Integration Testing
This stage is recommended for large organisations and requires a test environment containing at a minimum:
- A domain controller.
- A WEF server.
- A test workstation.
- All domain joined.
During this stage, the full SOP is implemented. Correct operation can be debugged and verified by monitoring the Forwarded Events log and checking the logs of the source systems as per the SOP.
Step 2 - HyperCollector WEF Integration Testing
During this stage a HyperCollector is deployed and the HyperSec NXLog, HyperSec Native or Winlogbeat agent is installed on the WEC servers (only). That agent is then configured to send data to the HyperCollector.
The automation-assisted NXLog CE deployment is the recommended default for HyperCollector 2.0 and HyperSec XDR 2.1.
HyperSec Native is the recommended default for HyperCollector 2.1 and HyperSec XDR 2.2.
Event data from the HyperCollector can then be sent to a local environment, store or simply cached locally with inbound metrics monitored to verify operation.
WEC Server Deployment
A single (or multiple depending on anticipated volume) WEC server is deployed into the environment and the SOP is performed on the environment. The group policy is created but not applied immediately.
The group policy is then applied progressively using OU or group application to an increasingly wider host base. Successful deployment can be verified using the Windows forwarded logs on the WEC server, or at the destination environment (HyperSec XDR, file system or an alternate SIEM) if this configured at integrated at this stage. There is nothing to preclude earlier integration of these destinations for the deployment.
Stage 1 - Initial Group
This deployment is a small group of easily configured systems and is used to validate the group policy deployment. Ideally this is a group of workstations with a small number of servers added once this is successful.
Stage 2 - Wider General Purpose Groups
This deployment expands the deployment to common general purpose systems group by group or by OU. This is often office automation environment and general purpose servers.
Stage 3 - Mission Critical
This deployment expands to domain controllers, database servers and other mission critical hosts.
Updates
Updates are typically not required, this being a benefit of this approach. In some cases modifications and improvements to group policy audit settings may be provided with updated releases of the HyperCollector integration.