Realm.Security Documentation

Appearance

Windows Event Logs ​

Realm Security integrates seamlessly with Windows Event Logs, enabling intelligent routing and analysis of security event logs.

Realm supports two approaches for collecting Windows Event Logs:

Approach 1: Realm Collector via WEF/WEC ​

Data Flow ​

text
Windows Endpoint → via (WEF) Windows Event Forwarder → Windows Event Collector Server (WEC) VM → Realm Data Collector (running on same VM as WEC) → Realm Cloud

Use Windows Event Forwarder to collect logs from all endpoints/servers to a Windows Event Collector Server (WEC). Install the Realm Data Collector on the WEC VM. The Realm Data Collector will collect logs from the Forwarded Event channel.

Setup Windows Event Logs Source in Realm ​

  1. Login to Realm console.
  2. Go to Sources > Add > Windows Event Logs (XML) and add a new Source.

    Name: Windows Event LogsDescription: Windows Event Logs

  3. If a collector is already set up, go to Collectors and select your collector. If not, add a new collector.
  4. Add a Windows Event Logs stream to the Collector. Click Add Stream.

    Product Format: Windows Event Logs (XML)Source: Windows Event LogsStream Type: Windows Local
    Polling Interval: Configure the poll interval of your choosing, or use the default of 5 seconds. Max Reads: Configure the maximum number of events to read per polling interval, or use the default of 100 events.

  5. Click Add Stream.

Prerequisites ​

  • Ensure you have administrative access to your Windows machine.
  • Realm Collector is set up and running. See Realm Collector install guide for setting up a collector.

Windows Event Forwarder ​

Follow this guide to configure Windows Event Forwarder: Setting up a Source-Initiated Subscription

References ​

Approach 2: Syslog via NXLog or Similar ​

Data Flow ​

text
Windows Endpoint → NXLog (XML) → TCP → Realm Collector stream → Realm Cloud

This approach is useful when you are already running a log shipper such as NXLog and want to forward events directly to the Realm Collector without setting up a WEC server. Events are converted to XML delimited by new lines and sent over TCP.

Step 1: Create a Source in Realm ​

  1. In Realm, go to Sources > Add Source.
  2. Enter a name for your source.
  3. Set Product Format to Windows Event Logs (XML).
  4. Click Save.

Step 2: Add a Collector Stream ​

  1. On the Select Transport Method step in the Add Source flow, select Collector > create a new collector or select an existing one > click Continue to add a stream.

Note: Alternatively, create a stream from the Collectors page by selecting a collector and clicking Add Stream.

  1. Configure the collector stream:
    • Name: Give the stream a name.
    • Stream Type: Select TCP.
    • Port: Use the preconfigured port or change it to suit your environment (e.g., 1514).
    • Framing Trailer: Select the framing trailer that matches your NXLog output (typically newline \n).
  2. Click Create Stream.
  3. Note the Collector IP address and Port — you will need these in the NXLog configuration.

Step 3: Configure NXLog ​

Here is a sample NXLog config file nxlog.conf to export Windows Event Logs as XML over raw TCP stream. Replace <collector_ip> and <collector_port> with the values from Step 2. Ensure that the XML logs are sent over raw TCP stream to the collector, not wrapped inside a syslog wrapper.

XML format (recommended):

ini
<Extension _xml>
    Module    xm_xml
</Extension>

<Input eventlog>
    Module    im_msvistalog
</Input>

<Output realm_tcp>
    Module      om_tcp
    Host        <collector_ip>:<collector_port>
    Exec        $raw_event = to_xml(); $raw_event =~ s/[\r\n\t]+/ /g;
    OutputType  LineBased
</Output>

<Route r>
    Path      eventlog => realm_tcp
</Route>

References ​