#
# Configuration for converting and sending Windows logs
# to AlienVault USM Anywhere.
#
# Version: 0.2.12
# Last modification: 2020-06-18
#

define ROOT C:\Program Files (x86)\nxlog
define OUTPUT_DESTINATION_ADDRESS usmsensoriphere
define OUTPUT_DESTINATION_PORT 514

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log


<Extension json>
    Module      xm_json
</Extension>

<Extension syslog>
    Module      xm_syslog
</Extension>

<Input internal>
    Module      im_internal
</Input>

<Input eventlog>
    Module      im_msvistalog
    Query       <QueryList>\
                    <Query Id="0">\
                        <Select Path="Application">*</Select>\
                        <Select Path="System">*</Select>\
                        <Select Path="Security">*</Select>\
                    </Query>\
                </QueryList>
    Exec if ($EventID == 5156) OR ($EventID == 5158) drop();
</Input>


<Output out>

Module      om_udp
Host        %OUTPUT_DESTINATION_ADDRESS%
Port        %OUTPUT_DESTINATION_PORT%
Exec        $EventTime = integer($EventTime) / 1000000;
Exec        $EventReceivedTime = integer($EventReceivedTime) / 1000000;
Exec        $Message = to_json(); to_syslog_bsd();

</Output>

<Route 1>
Path 	eventlog, internal => out
</Route>

############################################################################
####                      NXLOG WITH PATTERNDB                         #####
####    Uncomment the following lines for Windows Events filtered      #####
############################################################################

#<Input internal_Pattern>
#    Module      im_internal
#</Input>

#<Input eventlog_Pattern>
#    Module      im_msvistalog
#    Query       <QueryList>\
#                    <Query Id="0">\
#                        <Select Path="Application">*</Select>\
#                        <Select Path="System">*</Select>\
#                        <Select Path="Security">*</Select>\
#                    </Query>\
#                </QueryList>
#</Input>

#<Processor match_events>
#     Module          pm_pattern
#     PatternFile     %ROOT%\conf\patterndb.xml
#</Processor>

#<Output out_Pattern>
#    Module      om_udp
#    Host        %OUTPUT_DESTINATION_ADDRESS%
#    Port        %OUTPUT_DESTINATION_PORT%
#    Exec        $EventTime = integer($EventTime) / 1000000;
#    Exec        if not defined $PatternID or not defined $Message { drop(); }
#    Exec        $Message = to_json(); to_syslog_bsd();
#</Output>

#<Route route_Pattern>
#    Path 	eventlog_Pattern, internal_Pattern => match_events => out_Pattern
#</Route>

############################################################################
#####                     /NXLOG WITH PATTERNDB                        #####
############################################################################

############################################################################
####                             IIS-NXLOG                             #####
####       Uncomment the following lines for IIS log forwarding        #####
############################################################################

#<Extension IIS_w3c>
#   Module xm_csv
#   Fields $date, $time, $s_ip, $cs_method, $cs_uri_stem, $cs_uri_query, $s_port, $cs_username, $c_ip, $cs_User_Agent, $cs_Referer, $sc_status, $sc_substatus, $sc_win32_status, $time_taken
#   FieldTypes string, string, string, string, string, string, integer, string, string, string, string, integer, integer, integer, integer
#   Delimiter ' '
#</Extension>

#<Input IIS_IN>
#   Module im_file
#   File "C:\\inetpub\\logs\\LogFiles\\W3SVC1\\u_ex*"
#   SavePos TRUE

#   Exec if $raw_event =~ /^#/ drop(); \
#   else \
#   { \
#   IIS_w3c->parse_csv(); \
#   $EventTime = parsedate($date + " " + $time); \
#   $SourceName = "IIS"; \
#   }
#</Input>

#<Output IIS_OUT>
#   Module om_udp
#   Host %OUTPUT_DESTINATION_ADDRESS%
#   Port %OUTPUT_DESTINATION_PORT%
#   Exec $EventTime = strftime($EventTime, '%Y-%m-%d %H:%M:%S');
#   Exec $Message = to_json(); to_syslog_bsd();
#</Output>

#<Route IIS_Route>
#   Path IIS_IN => IIS_OUT
#</Route>

############################################################################
#####                         /IIS-NXLOG                               #####
############################################################################

#######################################################################################################
####                                      IIS-NXLOG-Extended                                      #####
#### NOTE: USE THIS CONF FOR IIS LOGS WITH CS-HOST, SC-BYTES, CS-BYTES AND X-FORWARDED-FOR FIELDS #####
####                      Uncomment the following lines for IIS log forwarding                    #####
#######################################################################################################

#<Extension IIS_w3c_extended>
#  Module xm_csv
#  Fields $date, $time, $s_ip, $cs_method, $cs_uri_stem, $cs_uri_query, $s_port, $cs_username, $c_ip, $cs_User_Agent, $cs_Referer, $cs_host, $sc_status, $sc_substatus, $sc_win32_status, $sc_bytes, $cs_bytes, $time_taken, $x-forwarded-for
#  FieldTypes string, string, string, string, string, string, integer, string, string, string, string, string, integer, integer, integer, integer, integer,integer, string
#  Delimiter ' '
#</Extension>

#<Input IIS_Extended_IN>
#  Module im_file
#  File "C:\\inetpub\\logs\\LogFiles\\W3SVC1\\u_ex*"
#  SavePos TRUE
#  Exec if $raw_event =~ /^#/ drop(); \
#  else \
#  { \
#    IIS_w3c_extended->parse_csv(); \
#    $EventTime = parsedate($date + " " + $time); \
#    $SourceName = "IIS"; \
#  }
#</Input>

#<Output IIS_Extended_OUT>
#  Module om_udp
#  Host %OUTPUT_DESTINATION_ADDRESS%
#  Port %OUTPUT_DESTINATION_PORT%
#  Exec $EventTime = strftime($EventTime, '%Y-%m-%d %H:%M:%S');
#  Exec $Message = to_json(); to_syslog_bsd();
#</Output>

#<Route IIS_Extended_Route>
#  Path	IIS_Extended_IN => IIS_Extended_OUT
#</Route>

############################################################################
#####                    /IIS-NXLOG-Extended                           #####
############################################################################

#######################################################################################################
####                                     IIS-NXLOG-Extended-V2                                    #####
#### NOTE: USE THIS CONF FOR IIS LOGS WITH CS-HOST, SC-BYTES, CS-BYTES, CS-VERSION, CS-COOKIE     #####
#### CLIENTIP AND TISUSER FIELDS                                                                  #####
####                      Uncomment the following lines for IIS log forwarding                    #####
#######################################################################################################

#<Extension IIS_w3c_extended_V2>
#  Module xm_csv
#  Fields $date, $time, $s_ip, $cs_method, $cs_uri_stem, $cs_uri_query, $s_port, $cs_username, $c_ip, $cs-version, $cs_User_Agent, $cs_cookie, $cs_Referer, $cs_host, $sc_status, $sc_substatus, $sc_win32_status, $sc_bytes, $cs_bytes, $time_taken, $clientIP, $TISUSER
#  FieldTypes string, string, string, string, string, string, integer, string, string, string, string, string, string, string, integer, integer, integer, integer, integer, integer, string, string
#  Delimiter ' '
#</Extension>

#<Input IIS_Extended_IN_V2>
#  Module im_file
#  File "C:\\inetpub\\logs\\LogFiles\\W3SVC1\\u_ex*"
#  SavePos TRUE
#  Exec if $raw_event =~ /^#/ drop(); \
#  else \
#  { \
#    IIS_w3c_extended_V2->parse_csv(); \
#    $EventTime = parsedate($date + " " + $time); \
#    $SourceName = "IIS"; \
#  }
#</Input>

#<Output IIS_Extended_OUT_V2>
#  Module om_udp
#  Host %OUTPUT_DESTINATION_ADDRESS%
#  Port %OUTPUT_DESTINATION_PORT%
#  Exec $EventTime = strftime($EventTime, '%Y-%m-%d %H:%M:%S');
#  Exec $Message = to_json(); to_syslog_bsd();
#</Output>

#<Route IIS_Extended_Route_V2>
#  Path	IIS_Extended_IN_V2 => IIS_Extended_OUT_V2
#</Route>

############################################################################
#####                    /IIS-NXLOG-Extended-V2                        #####
############################################################################

############################################################################
####                          WINDOWS-FW-NXLOG                         #####
#### Uncomment the following lines for WINDOWS FIREWALL log forwarding #####
############################################################################

#<Extension transform_alienvault_csv_windows_firewall>
#    Module          xm_csv
#    Fields          date, time, action, protocol, src-ip, dst-ip, src-port, dst-port, size, tcpflags, tcpsyn, tcpack, tcpwin, icmptype, icmpcode, info, path
#    FieldTypes      string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string
#    Delimiter       ' '
#</Extension>

#<Input FW_IN>
#    Module      im_file
#    File        "C:\\Windows\\System32\\LogFiles\\Firewall\\pfirewall.log"
#   SavePos     TRUE
#   InputType   LineBased
#      Exec if $raw_event =~ /^#/ drop();\
#      else\
#       {\
#               transform_alienvault_csv_windows_firewall->parse_csv();\
#               $EventTime = parsedate($date + " " + $time); \
#               $Message = $raw_event; \
#               $SourceName = "WINDOWS-FW";\
#       }
#</Input>

#<Output FW_OUT>
#   Module om_udp
#   Host %OUTPUT_DESTINATION_ADDRESS%
#   Port %OUTPUT_DESTINATION_PORT%
#   Exec $EventTime = strftime($EventTime, '%Y-%m-%d %H:%M:%S, %z');
#   Exec $Message = to_json(); to_syslog_bsd();
#</Output>

#<Route route_windows_fw_nxlog>
#    Path        FW_IN => FW_OUT
#</Route>

############################################################################
####                          /WINDOWS-FW-NXLOG                        #####
############################################################################

############################################################################
####                             DHCP-NXLOG                            #####
####     Uncomment the following lines for DHCP log forwarding         #####
####     Use "system32" for DHCP Log location on 32 Bit systems        #####
############################################################################

#<Extension transform_alienvault_dhcp_csv>
#
#    Module          xm_csv
#    Fields          $EventReceivedTime, $Message
#    FieldTypes      string, string
#    Delimiter       ;
#
#</Extension>


#<Input DHCP_IN>
#    Module      im_file
#    File        "C:\\Windows\\Sysnative\\dhcp\\DhcpSrvLog-*.log"
#    SavePos     TRUE
#    InputType   LineBased
#    Exec        if $raw_event =~ /^[0-3][0-9],/\
#                {\
#                      $Message = $raw_event;\
#                      if $Message =~ s/^00/1000/;\
#                      $raw_event = to_json();\
#                      $SourceName = "DHCP-NXLOG";\
#                }\
#                else\
#                      drop();
#</Input>

#<Output DHCP_OUT>
#    Module      om_udp
#    Host        %OUTPUT_DESTINATION_ADDRESS%
#    Port        %OUTPUT_DESTINATION_PORT%
#    Exec        $Hostname = hostname_fqdn();
#    Exec        transform_alienvault_dhcp_csv->to_csv(); to_syslog_bsd();
#</Output>

#<Route DHCP>
#    Path DHCP_IN => DHCP_OUT
#</Route>

#######################################################################
####                        /DHCP-NXLOG                           #####
#######################################################################

#######################################################################
####                          DNS-NXLOG                           #####
####     Uncomment the following lines for DNS log forwarding     #####
####     Use C:\\Logs\\dns.log File location for 32 Bit Systems   #####
#######################################################################
#
#<Input DNS_IN>
#   Module    im_file
#   File    "C:\\Windows\\Sysnative\\dns\\dns.log"
#   SavePos  TRUE
#   InputType LineBased
#   Exec if ($raw_event =~ /^#/) OR ($raw_event == '') drop();\
#       else\
#           {\
#           $Message = $raw_event;\
#           $SourceName = "DNS";\
#           $raw_event = to_json();\
#           }
#</Input>
#
#<Output DNS_OUT>
#   Module          om_udp
#   Host            %OUTPUT_DESTINATION_ADDRESS%
#   Port            %OUTPUT_DESTINATION_PORT%
#   Exec            if not defined $Message { drop(); }
#   Exec            $Message = replace($Message, "a.m.", "AM");
#   Exec            $Message = replace($Message, "p.m.", "PM");
#
#   Exec            $Message = replace($Message, "\t", " "); $Message = replace($Message, "\n", " "); $Message = replace($Message, "\r", " ");
#
#   Exec            if not defined $AccountName { $AccountName = "-"; }
#   Exec            if not defined $AccountType { $AccountType = "-"; }
#   Exec            if not defined $Domain { $Domain = "-"; }
#
#   Exec	    	 $Hostname = hostname_fqdn();
#   Exec            $raw_event = $Hostname + ' DNS-NXLOG: ' + $raw_event;
#   Exec            $Message = to_json(); to_syslog_bsd();
#</Output>
#
#<Route route_dns_nxlog>
#   Path        DNS_IN => DNS_OUT
#</Route>
#
#######################################################################
####                         /DNS-NXLOG                           #####
#######################################################################

#######################################################################
####                          EXCHANGE                            #####
####   Uncomment the following lines for Exchange log forwarding  #####
#######################################################################
#<Extension transform_alienvault_csv_exchange>
#Module         	xm_csv
#Fields	    	    date_time, client_ip, client_hostname, server_ip, server_hostname, source_context, connector_id, source, event_id, internal_message_id, message_id, network_message_id, recipient_address, recipient_status, total_bytes, recipient_count, related_recipient_address, reference, message_subject, sender_address, return_path, message_info, directionality, tenant_id, original_client_ip, original_server_ip, custom_data, transport_traffic_type, log_id, schema_version
#FieldTypes 		string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string
#Delimiter      	,
#</Extension>
#
#<Input EXCHANGE_IN>
#
#Module      im_file
## Modify the file path if it is needed
#File        "C:\\Program Files\\Microsoft\\Exchange Server\\V15\\TransportRoles\\Logs\\MessageTracking\\MSGTRK????????*-*.log"
#SavePos     TRUE
#Exec if ($raw_event =~ /^#/) OR ($raw_event =~ /HealthMailbox/) drop();\
#else\
#{\
#transform_alienvault_csv_exchange->parse_csv();\
#$Message = $raw_event;\
#$SourceName = "EXCHANGE-NXLOG";\
#}
#</Input>
#
#<Output EXCHANGE_OUT>
#
#Module      om_udp
#Host        %OUTPUT_DESTINATION_ADDRESS%
#Port        %OUTPUT_DESTINATION_PORT%
#Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000;
#Exec $Message = to_json(); to_syslog_bsd();
#
#</Output>
#
#<Route EXCHANGE>
#
#Path EXCHANGE_IN => EXCHANGE_OUT
#
#</Route>
#
#######################################################################
####                          /EXCHANGE                           #####
#######################################################################


######################################################################################
####                                 MSSQL-NXLOG                                 #####
####   Uncomment the following lines for MSSQL log forwarding                    #####
####  The audit mssql logs must be added to Application when enabling auditing.  #####
######################################################################################

#<Input MSSQL_IN>
#Module          im_msvistalog
#SavePos         FALSE
#ReadFromLast    TRUE

#Query          <QueryList>                                         \
#                   <Query Id="0">                                  \
#                       <Select Path="Application">*[System[(EventID='33205')]]</Select>\
#                   </Query>                                    \
#               </QueryList>
#Exec			$Message = $raw_event;
#Exec           if $raw_event =~ /^#/ drop();\
#               else\
#               {\
#                   $SourceName = "MSSQL-NXLOG";\
#               }

#Exec			 if $raw_event =~ /action_id:(\S+)/ $Action_ID = $1;
#Exec			 if $raw_event =~ /database_name:(\S+)/ $DataBase = $1;
#Exec			 if $raw_event =~ /server_instance_name:(\S+)/ $SV_Instace = $1;
#Exec			 if $raw_event =~ /session_server_principal_name:(\S+)/ $User = $1;
#Exec			 if $raw_event =~ /AUDIT_SUCCESS/\
#{\
#$Result = 'Success';\
#}\
#else\
#$Result = 'Failure';
#Exec            $Message = replace($Message, "\t", " "); $Message = replace($Message, "\n", " "); $Message = replace($Message, "\r", " ");
#</Input>

#<Output MSSQL_OUT>
#Module          om_udp
#Host            %OUTPUT_DESTINATION_ADDRESS%
#Port            %OUTPUT_DESTINATION_PORT%

# Exec 			$Message = to_json(); to_syslog_bsd();

#</Output>


#<Route mssql>
#Path            MSSQL_IN => MSSQL_OUT
#</Route>

#######################################################################
####                       /MSSQL-NXLOG                           #####
#######################################################################


#######################################################################
####                        ObserveIT                             #####
####   Uncomment the following lines for ObserveIT log forwarding #####
#######################################################################

#<Input ObserveITin>
#    Module    im_file
#    File    "C:\\Program Files (x86)\\ObserveIT\\NotificationService\\LogFiles\\ArcSight\\Observeit_activity_log.cef"
#    SavePos  TRUE
#    InputType LineBased
#    Exec if $raw_event =~ /(CEF:.*)/ $Message = $1;
#    Exec to_syslog_bsd();
#</Input>

#<Output ObserveITout>
#    Module          om_udp
#    Host            %OUTPUT_DESTINATION_ADDRESS%
#    Port            %OUTPUT_DESTINATION_PORT%
#</Output>

#<Route ObserveITroute>
#    Path ObserveITin => ObserveITout
#</Route>

#######################################################################
####                       ObserveIT                              #####
#######################################################################

#######################################################################
####                         SOPHOSEC-NXLOG                       #####
####   Uncomment the following lines for Sophos-EC log forwarding #####
#######################################################################

#<Extension kvp>
#    Module          xm_kvp
#    KVPDelimiter    ;
#    KVDelimiter     =
#</Extension>

#<Extension syslog>
#    Module  xm_syslog
#</Extension>

##Sophosec logs assumed they are located in default location
#<Input SOPHOS_IN>

#    Module      im_file
#    File        "C:\\Program Files (x86)\\Sophos\\Reporting Interface\\Log Files\\DefaultCommonEvents.txt"
#    SavePos     TRUE
#    InputType   LineBased
#    Exec if $raw_event =~ /^#/ drop();\
#    else\
#    {\
#       kvp->parse_kvp();\
#       $Message = $raw_event;\
#    }
#</Input>


#<Output SOPHOS_OUT>

#    Module      om_udp
#    Host        %OUTPUT_DESTINATION_ADDRESS%
#    Port        %OUTPUT_DESTINATION_PORT%
#    Exec        $Hostname = hostname_fqdn();
#    Exec        to_syslog_bsd();
#    Exec        $raw_event = '<13>' + $Hostname + ' SOPHOSEC-NXLOG: ' + 'InsertedAt="' +$InsertedAt + '"; ' + 'EventID="' +$EventID + '"; ' + 'EventTime="' +$EventTime + '"; ' + 'EventTypeID="' +$EventTypeID + '"; ' + 'EventType="' +$EventType + '"; ' + 'Name="' +$Name + '"; ' + 'ReportingName="' +$ReportingName + '"; ' + 'UserName="' +$UserName + '"; ' + 'ActionID="' +$ActionID + '"; ' + 'Action="' +$Action + '"; ' + 'ScanType="' +$ScanType + '"; ' + 'SubTypeID="' +$SubTypeID + '"; ' + 'SubType="' +$SubType + '"; ' + 'ComputerName="' +$ComputerName + '"; ' + 'ComputerDomain="' +$ComputerDomain + '"; ' + 'ComputerIPAddress="' + $ComputerIPAddress + '"';

#</Output>


#<Route Sophos>

#    Path SOPHOS_IN => SOPHOS_OUT

#</Route>

#######################################################################
####                        /SOPHOSEC-NXLOG                       #####
#######################################################################


#########################################################################
####                        APACHE-NXLOG                            #####
####   Uncomment the following lines for Apache log forwarding      #####
####   If Xampp is not used replace the path with the according one #####
#########################################################################

#<Input APACHE_IN>
#   Module  im_file
#   File    "C:\\xampp\\apache\\logs\\access.log"
#   Exec    $SourceName = "APACHE-NXLOG";
#</Input>

#<Output APACHE_OUT>
#   Module    om_udp
#   Host      %OUTPUT_DESTINATION_ADDRESS%
#   Port      %OUTPUT_DESTINATION_PORT%
#   Exec      to_syslog_bsd();
#</Output>

#<Route Apache>
#   Path APACHE_IN => APACHE_OUT
#</Route>

##########################################################################
####                       /APACHE-NXLOG                             #####
##########################################################################


############################################################################
####                            NETWRIX-NXLOG                          #####
####     Uncomment the following lines for NETWRIX log forwarding      #####
############################################################################
#
#<Extension transform_alienvault_csv_netwrix>
#    Module          xm_csv
#    Fields          $EventTime, $EventType, $Severity, $Channel, $Hostname, $EventID, $SourceName, $Task, $Keywords, $Message
#    FieldTypes      string, string, string, string, string, string, string, string, string, string
#    Delimiter       ;
#</Extension>
#
#<Input NETWRIX_Logs>
#    Module      	im_msvistalog
#    SavePos	 		FALSE
#    ReadFromLast	TRUE
#    Query           <QueryList>                                         			\
#                        <Query Id="0">                                  				\
#                            <Select Path="Netwrix_Auditor_Integration">*</Select>   	\
#                        </Query>                                			    \
#                    </QueryList>
#
#    Exec    $SourceName = "NETWRIX-NXLOG";
#</Input>
#
#<Output out_alienvault_netwrix_nxlog>
#    Module      om_udp
#    Host        %OUTPUT_DESTINATION_ADDRESS%
#    Port        %OUTPUT_DESTINATION_PORT%
#
#    Exec		$Message = replace($Message, "\n", ">>");
#
#    Exec    	$Hostname = hostname_fqdn();
#    Exec        transform_alienvault_csv_netwrix->to_csv();
#    Exec 		$Message = to_json(); to_syslog_bsd();
#</Output>
#
#<Route route_netwrix_nxlog>
#    Path        NETWRIX_Logs => out_alienvault_netwrix_nxlog
#</Route>
#######################################################################
####                     /NETWRIX-NXLOG                           #####
#######################################################################

############################################################################
####                            DELL-BOOMI-ATOM                        #####
####  Uncomment the following lines for DELL-BOOMI-ATOM log forwarding #####
############################################################################
#
#  <Extension transform_alienvault_csv_dell>
#    Module          xm_csv
#    Fields          $type, $containerId, $accountId, $userId, $date, $event_message, $type2, $action, $modifier, $level, $source, $name, $value
#    FieldTypes      string, string, string, string, string, string, string, string, string, string, string, string, string
#    Delimiter       '	'
#  </Extension>
#
#  <Input DELL_IN>
#    Module      im_file
#    File        "..\\<atom_install_root>\\logs"
#    SavePos     TRUE
#    InputType   LineBased
#    Exec if $raw_event =~ /^#/ drop();\
#    else\
#    {\
#      transform_alienvault_csv_dell->parse_csv();\
#      $Message = $raw_event; \
#      $SourceName = "DELL-BOOMI-ATOM-NXLOG";\
#    }
#  </Input>
#
#  <Output DELL_OUT>
#    Module      om_udp
#    Host        %OUTPUT_DESTINATION_ADDRESS%
#    Port        %OUTPUT_DESTINATION_PORT%
#
#    Exec        $Message = replace($Message, "\t", " ");
#
#    Exec    	$Hostname = hostname_fqdn();
#    Exec       transform_alienvault_csv_dell->to_csv();
#    Exec 		$Message = to_json(); to_syslog_bsd();
#  </Output>
#
#  <Route route_dell_boomi>
#    Path        DELL_IN => DELL_OUT
#  </Route>
#######################################################################
####                     /DELL-BOOMI-ATOM                         #####
#######################################################################

#######################################################################
####                            FTP-NXLOG                         #####
####     Uncomment the following lines for FTP log forwarding     #####
#######################################################################
#
#<Extension w3c_ftp>
#    Module xm_csv
#    Fields date, time, c-ip, cs-username, s-ip, s-port, cs-method, cs-uri-stem, sc-status, sc-win32-status, sc-substatus, x-session, x-fullpath
#    FieldTypes string, string, string, string, string, string, string, string, string, string, string, string, string
#    Delimiter ' '
#</Extension>
#
## Windows FTP events log:
#<Input FTP_Logs>
#    Module im_file
#    File "C:\\inetpub\\logs\\LogFiles\\FTPSVC\\u_ex*"
#    SavePos TRUE
#
#    Exec if $raw_event =~/^#/ drop();\
#    else\
#    {\
#        w3c_ftp->parse_csv();\
#        $EventTime = parsedate($date + " " + $time);\
#        $SourceName = "WINFTP";\
#        $raw_event = to_json();\
#    }
#</Input>
#
## Output internal ftp nxlog messages:
#<Output out_alienvault_ftp_nxlog>
#    Module om_udp
#    Host %OUTPUT_DESTINATION_ADDRESS%
#    Port %OUTPUT_DESTINATION_PORT%
#    Exec $Hostname = hostname_fqdn();
#    Exec $raw_event =$Hostname + ' WINFTP-NXLOG ' + $raw_event;
#</Output>
#
## Route for ftp nxlog logs:
#<Route route_ftp_nxlog>
#    Path FTP_Logs => out_alienvault_ftp_nxlog
#</Route>
#######################################################################
####                           /FTP-NXLOG                         #####
#######################################################################

#######################################################################
####                DUO-AUTHENTICATION-PROXY-NXLOG                #####
####  Uncomment the following lines for Duo Authentication Proxy  #####
####                        log forwarding                        #####
#######################################################################

#<Input DUO_IN>
#    Module im_file
#    File "..\\<duo_authentication_proxy>\\logs"
#    SavePos TRUE
#    ReadFromLast TRUE
#    PollInterval 1
#    Exec $Message = $raw_event;
#    Exec $SourceName = "DUO-PROXY-NXLOG";
#</Input>
#
#<Output DUO_OUT>
#    Module      om_udp
#    Host        %OUTPUT_DESTINATION_ADDRESS%
#    Port        %OUTPUT_DESTINATION_PORT%
#
#    Exec        to_syslog_bsd();
#</Output>
#
#<Route DUO>
#    Path DUO_IN => DUO_OUT
#</Route>

#######################################################################
####                /DUO-AUTHENTICATION-PROXY-NXLOG               #####
#######################################################################


############################################################################
####                         NPS-NXLOG                                 #####
####    Uncomment the following lines for NPS-NXLOG log forwarding     #####
####    Use "system32" for LogFiles Log location on 32 Bit systems     #####
############################################################################
#<Extension xmlparser>
# Module xm_xml
#</Extension>

#<Input NPS_IN>
#  Module im_file
#  File "C:\\Windows\\Sysnative\\LogFiles\\IN*.log"
#  SavePos TRUE
#  InputType LineBased
#  Exec if ($raw_event =~ /^#/) OR ($raw_event == '') drop();\
#  else\
#  {\
#    parse_xml();\
#    $Message = $raw_event;\
#    $SourceName = "NPS-NXLOG";\
#    $raw_event = to_json();\
#  }
#</Input>

#<Output NPS_OUT>
#  Module om_udp
#  Host %OUTPUT_DESTINATION_ADDRESS%
#  Port %OUTPUT_DESTINATION_PORT%
#  Exec $Hostname = hostname_fqdn();
#  Exec $Message = replace($Message, '"', "");
# Exec $Message = to_json(); to_syslog_bsd();
#</Output>

#<Route NPS>
#  Path NPS_IN => NPS_OUT
#</Route>

#######################################################################
####                        /NPS-NXLOG                            #####
#######################################################################

#######################################################################
####                         HTTP-API-2.0-NXLOG                   #####
####    Uncomment the following lines for HTTP-API-2.0-NXLOG      #####
####                          log forwarding                      #####
#######################################################################
#<Extension w3c_http_api>
#   Module xm_csv
#   Fields $date, $time, $c-ip, $c-port, $s-ip, $s-port, $cs-version, $cs-method, $cs-uri, $sc-status, $s-siteid, $s-reason, $s-queuename
#   FieldTypes string, string, string, integer, string, integer, string, string, string, integer, string, string, string
#   Delimiter ' '
#</Extension>
#
#<Input HTTP_API_IN>
#    Module im_file
#    File "C:\\Windows\\System32\\LogFiles\\HTTPERR\\httperr*"
#    Exec if $raw_event =~ /^#/ drop();\
#    else\
#    {\
#        w3c_http_api->parse_csv();\
#        $EventTime = parsedate($date + " " + $time);\
#        $SourceName = "HTTP-API-NXLOG";\
#    }
#</Input>
#
#<Output HTTP_API_OUT>
#    Module om_udp
#    Host %OUTPUT_DESTINATION_ADDRESS%
#    Port %OUTPUT_DESTINATION_PORT%
#    Exec to_syslog_bsd();
#</Output>
#
#<Route HTTP_API>
#    Path HTTP_API_IN => HTTP_API_OUT
#</Route>
#######################################################################
####                       HTTP-API-2.0-NXLOG                     #####
#######################################################################

#######################################################################
####                          FORCEPOINT-NXLOG                    #####
####     Uncomment the following lines for FORCEPOINT-NXLOG       #####
####                          log forwarding                      #####
#######################################################################
#<Extension transform_alienvault_csv_forcepoint>
#    Module xm_csv
#    Fields $date, $time, $workstation, $user, $connection-ip, $source-ip, $url, $port, $action, $policy-name, $risk-class, $analytic-name, $severity, $threat-name, $threat-type
#    FieldTypes string, string, string, string, string, string, string, integer, string, string, string, string, string, string, string
#</Extension>
#
#<Input FORCEPOINT_IN>
#    Module im_file
#    File "C:\\ForcepointSIEMExporter\\tmp\\nxlog_input\\file_logs"
#    SavePos FALSE
#    InputType LineBased
#    <Exec>
#        if $raw_event =~ /^"Date"/ drop();
#        else{
#            transform_alienvault_csv_forcepoint->parse_csv();
#            $EventTime = parsedate($date + " " + $time);
#            $Message = $raw_event;
#            $SourceName = "FORCEPOINT-NXLOG";
#        }
#    </Exec>
#</Input>
#
#<Output FORCEPOINT_OUT>
#    Module om_udp
#    Host %OUTPUT_DESTINATION_ADDRESS%
#    Port %OUTPUT_DESTINATION_PORT%
#    Exec $EventTime = strftime($EventTime, '%d-%m-%Y %H:%M:%S, %z');
#    Exec $Message = to_json(); to_syslog_bsd();
#</Output>
#
#<Route route_windows_fp_nxlog>
#    Path FORCEPOINT_IN => FORCEPOINT_OUT
#</Route>
#######################################################################
####                        FORCEPOINT-NXLOG                      #####
#######################################################################

#######################################################################
####                        SHAREPOINT-NXLOG                      #####
####     Uncomment the following lines for SharePoint-NXLOG       #####
####                          log forwarding                      #####
#######################################################################
#<Extension transform_alienvault_csv_sharepoint>
#    Module      xm_csv
#    Fields      $Timestamp, $Process, $TID, $Area, $Category, $EventID, $Level, $Message, $Correlation
#    FieldTypes  string, string, string, string, string, string, string, string, string
#    Delimiter   \t
#</Extension>
#
#<Input SHAREPOINT_IN>
#    Module im_file
#    File "..\\<sharepoints_logs_file>\\logs"
#    <Exec>
#        # Drop header lines and empty lines
#        if $raw_event =~ /^(\xEF\xBB\xBF|Timestamp)/ drop();
#        else
#        {
#            $raw_event =~ s/ +(?=\t)//g;
#            transform_alienvault_csv_sharepoint->parse_csv();
#            $EventTime = strptime($Timestamp, "%m/%d/%Y %H:%M:%S");
#            $Hostname = hostname_fqdn();
#            $SourceName = "SHAREPOINT-NXLOG";
#        }
#    </Exec>
#</Input>
#
#<Output SHAREPOINT_OUT>
#    Module om_udp
#    Host %OUTPUT_DESTINATION_ADDRESS%
#    Port %OUTPUT_DESTINATION_PORT%
#    Exec $EventTime = strftime($EventTime, '%Y-%m-%d %H:%M:%S');
#    Exec $Message = to_json(); to_syslog_bsd();
#</Output>
#
#<Route SP_Route>
#    Path SHAREPOINT_IN => SHAREPOINT_OUT
#</Route>
#######################################################################
####                        SHAREPOINT-NXLOG                      #####
#######################################################################

#######################################################################
####                    ORACLE-CLOUD-AUDIT-NXLOG                  #####
#### Uncomment the following lines for Oracle Cloud Audit-NXLOG   #####
####                          log forwarding                      #####
#######################################################################
#<Input ORACLE_CLOUD_AUDIT_IN>
#    Module im_file
#    File 'C:\\OCI\\logs\\Audit_events_*.log'
#    SavePos TRUE
#    ReadFromLast TRUE
#    PollInterval 1
#    Exec $Message = $raw_event;
#    Exec $SourceName = "ORACLE-CLOUD-AUDIT-NXLOG";
#</Input>
#
#<Output ORACLE_CLOUD_AUDIT_OUT>
#    Module om_udp
#    Host %OUTPUT_DESTINATION_ADDRESS%
#    Port %OUTPUT_DESTINATION_PORT%
#    Exec to_syslog_bsd();
#</Output>
#
#<Route ORACLE_CLOUD_AUDIT_Route>
#    Path ORACLE_CLOUD_AUDIT_IN => ORACLE_CLOUD_AUDIT_OUT
#</Route>
#######################################################################
####                    ORACLE-CLOUD-AUDIT-NXLOG                  #####
#######################################################################


############################################################################
####                            BITVISE-NXLOG                          #####
####     Uncomment the following lines for BITVISE log forwarding      #####
############################################################################

#<Input internal_Bitvise_Pattern>
#    Module      im_internal
#</Input>

#<Input BITVISE_IN>
#    Module      im_msvistalog
#    Query       <QueryList>\
#                    <Query Id="0">\
#                        <Select Path="Application">*</Select>\
#                    </Query>\
#                </QueryList>

#   Exec if not ($EventID == 4097) drop();
#   Exec        $SourceName = "BITVISE-NXLOG";
#</Input>

#<Output BITVISE_OUT>
#    Module      om_udp
#    Host        %OUTPUT_DESTINATION_ADDRESS%
#    Port        %OUTPUT_DESTINATION_PORT%
#    Exec        $EventTime = integer($EventTime) / 1000000;
#    Exec        $Message = to_json(); to_syslog_bsd();
#</Output>

#<Route Bitvise_Route>
#    Path   BITVISE_IN, internal_Bitvise_Pattern => BITVISE_OUT
#</Route>

#######################################################################
####                     /BITVISE-NXLOG                           #####
#######################################################################

############################################################################
####                             PA-Auth-NXLOG                         #####
####       Uncomment the following lines for PA Auth log forwarding    #####
############################################################################

#<Extension PA_auth>
#  Module xm_csv
#  Fields $date, $time, $status, $username, $application, $source_ip, $reason
#  FieldTypes string, string, string, string, string, string, string
#  Delimiter ','
#</Extension>

#<Input PA_auth_IN>
#  Module im_file
#  File "C:\\Program Files\\PA Server Monitor\\Logs\\PermLog_UserLogins*"
#  SavePos TRUE

#  Exec if $raw_event =~ /^#/ drop(); \
#  else \
#  { \
#  PA_auth->parse_csv(); \
#  $EventTime = parsedate($date + " " + $time); \
#  $SourceName = "PA-AUTH-NXLOG"; \
#  }
#</Input>

#<Output PA_auth_OUT>
#  Module om_udp
#  Host %OUTPUT_DESTINATION_ADDRESS%
#  Port %OUTPUT_DESTINATION_PORT%
#  Exec $EventTime = strftime($EventTime, '%Y-%m-%d %H:%M:%S');
#  Exec $Message = to_json(); to_syslog_bsd();
#</Output>

#<Route PA_Auth_Route>
#  Path PA_auth_IN => PA_auth_OUT
#</Route>

############################################################################
#####                         /PA-Auth-NXLOG                           #####
############################################################################

#######################################################################
####                          FIM-NXLOG-EE                        #####
####       Uncomment the following lines for FIM NXLOG EE         #####
####                          log forwarding                      #####
#######################################################################

#<Input fim>
#    Module          im_fim
#    File           'C:\Tools\*'
#    File	        'C:\Windows\System32\drivers\etc\*'
#    File           'C:\Program Files\*'
#    File           'C:\Program Files (x86)\*'
#    Exclude        'C:\Program Files\nxlog\data\*'
#    Recursive      TRUE
#    ScanInterval   1800
#</Input>
#
#<Input registry>
#    Module          im_regmon
#    RegValue       'HKLM\Security\*'
#    RegValue       'HKLM\Software\Policies\*'
#    RegValue       'HKLM\Software\Classes\*'
#    RegValue       'HKLM\Software\Microsoft\*'
#    RegValue       'HKLM\System\CurrentControlSet\*'
#    Recursive      TRUE
#    ScanInterval   600
#</Input>
#
#<Output fim_out>
#    Module om_udp
#    Host %OUTPUT_DESTINATION_ADDRESS%
#    Port %OUTPUT_DESTINATION_PORT%
#    Exec $SourceName = "FMI-NXLOG-EE";
#    Exec $Message =to_json(); to_syslog_bsd();
#</Output>
#
#<Route fim_route>
#    Path        fim, registry => fim_out
#</Route>

#######################################################################
####                          FIM-NXLOG-EE                        #####
#######################################################################
