GSP714

Overview

Chronicle is a cloud service built as a specialized layer on top of core Google infrastructure. It is designed for enterprises to privately retain, analyze, and search the massive amounts of security and network telemetry they generate. Chronicle normalizes, indexes, correlates, and analyzes the data to provide instant analysis and context on risky activity.

Chronicle gives analysts a way, when they see a potential threat, to identify it and determine what it's doing, whether it matters, and how best to respond.

The Chronicle forwarder is one of many methods Chronicle uses to ingest security telemetry. The Chronicle forwarder is a lightweight software component deployed in the customer's network and supports syslog, packet capture, and existing log management or security information and event management (SIEM) data repositories.

In this lab, you configure a Chronicle forwarder on a Windows VM using a standard Docker image. You use labels to add searchable metadata to the logs to optimize analytical capabilities.

What you'll learn

In this lab, you learn how to perform the following tasks:

• Perform a basic installation of Docker on a Windows host.
• Install and configure the Chronicle forwarder on Windows.
• Send sample logs using the file collector.
• Install and configure NXLog Community Edition on Windows.
• Send Windows Logs to the Chronicle Forwarder using NXLog .

Setup and requirements

Before you click the Start Lab button

Read these instructions. Labs are timed and you cannot pause them. The timer, which starts when you click Start Lab, shows how long Google Cloud resources are made available to you.

This hands-on lab lets you do the lab activities in a real cloud environment, not in a simulation or demo environment. It does so by giving you new, temporary credentials you use to sign in and access Google Cloud for the duration of the lab.

To complete this lab, you need:

• Access to a standard internet browser (Chrome browser recommended).

Note: Use an Incognito (recommended) or private browser window to run this lab. This prevents conflicts between your personal account and the student account, which may cause extra charges incurred to your personal account.

• Time to complete the lab—remember, once you start, you cannot pause a lab.

Note: Use only the student account for this lab. If you use a different Google Cloud account, you may incur charges to that account.

How to start your lab and sign in to the Google Cloud console

1. Click the Start Lab button. If you need to pay for the lab, a dialog opens for you to select your payment method. On the left is the Lab Details pane with the following:

   • The Open Google Cloud console button
   • Time remaining
   • The temporary credentials that you must use for this lab
   • Other information, if needed, to step through this lab

2. Click Open Google Cloud console (or right-click and select Open Link in Incognito Window if you are running the Chrome browser).

   The lab spins up resources, and then opens another tab that shows the Sign in page.

   Tip: Arrange the tabs in separate windows, side-by-side.

   Note: If you see the Choose an account dialog, click Use Another Account.

3. If necessary, copy the Username below and paste it into the Sign in dialog.

   {{{user_0.username | "Username"}}}

   You can also find the Username in the Lab Details pane.

4. Click Next.

5. Copy the Password below and paste it into the Welcome dialog.

   {{{user_0.password | "Password"}}}

   You can also find the Password in the Lab Details pane.

6. Click Next.

   Important: You must use the credentials the lab provides you. Do not use your Google Cloud account credentials. Note: Using your own Google Cloud account for this lab may incur extra charges.

7. Click through the subsequent pages:

   • Accept the terms and conditions.
   • Do not add recovery options or two-factor authentication (because this is a temporary account).
   • Do not sign up for free trials.

After a few moments, the Google Cloud console opens in this tab.

Note: To access Google Cloud products and services, click the Navigation menu or type the service or product name in the Search field.

Task 1. Install Docker on Windows

In this task, you install and configure the forwarder on a Windows VM. To prepare, install and configure Docker into the VM instance.

Note: If you are using a Mac you should install the Remote Desktop Client before you start from the Remote Desktop Client Installer page.

1. In the Google Cloud console, in the Navigation menu (), click Compute Engine > VM instances. You should see listed in the VM instance list.

Note: As there may be a delay as the lab initially loads, check the Status of the VM instance. Wait for a green check to display before continuing on to the next step.

2. Inline with , click the RDP expand arrow and click Set Windows password.

3. Click Set in the Set new Windows password dialog. Copy and record the new password and then close the dialog.

4. Back in the VM instances list, click RDP and then click Download the RDP file if you will be using a 3rd-party client. This downloads an RDP file onto your local device.

5. Click to run the RDP file on your local device. It connects to the VM instance.

6. Login to using the password you recorded earlier (it may still be in your clipboard).

7. In , in the search box on the bottom, type "Powershell", and then right click on Windows PowerShell > Run as administrator.

8. Click Yes. This opens the Administrator: Windows PowerShell window.

Note: Save the Windows user password as you will log in again later. If you didn't save it you can always reset it again using Step 3.

9. Enable the Microsoft Windows container feature by running the following:

Install-WindowsFeature containers -Restart

This lets you package applications with their dependencies.

10. Click OK to restart the instance. The instance disconnects when the lab instance restarts.

11. To reconnect to the instance, click the RDP file you downloaded to your local device and log in with the password you previously recorded.

If you can't connect, most likely the Windows instance is still rebooting. Wait a minute and try again.

12. Reopen the Administrator: Windows PowerShell window and execute the following command to install Docker CE:

Invoke-WebRequest -UseBasicParsing "https://raw.githubusercontent.com/microsoft/Windows-Containers/Main/helpful_tools/Install-DockerCE/install-docker-ce.ps1" -o install-docker-ce.ps1 .\install-docker-ce.ps1

13. Verify the Docker installation.

docker --version

Output:

... C:\Users\student_02_4b53053b2> docker --version Docker version 26.0.0, build ed223bc

Check your learning:

Task 2. Install and configure the forwarder on Windows

In this task, you configure the Chronicle forwarder for Windows on the instance. You then review the logs on the forwarder to determine whether you made a successful connection.

1. Obtain the latest Docker image from Google Cloud using the Docker pull command:

docker pull gcr.io/chronicle-container/cf_production_stable_windows

It takes a few minutes to pull and extract the files.

2. Once the image has been pulled check that the image is present. docker images

Output:

... C:\Users\student_02_4b53053b2> docker images REPOSITORY TAG IMAGE ID CREATED SIZE gcr.io/chronicle-container/cf_production_stable_windows latest 6efe590c0302 11 months ago 6.89GB

3. Switch directory to the C:\config directory.

cd c:\config

4. Copy the Chronicle config file for this lab environment, chronicle_config.conf, from Cloud Storage to the config directory:

   gcloud storage cp gs://spls/gsp714/chronicle_config.conf .

5. Start the Chronicle forwarder from the Docker container:

docker run ` --detach ` --name cfps ` --restart=always ` --log-opt max-size=100m ` --log-opt max-file=10 ` --dns="8.8.8.8" ` -p 10514:10514 ` -v C:\config\:C:/opt/chronicle/external ` -v C:\data\:C:/opt/chronicle/data ` gcr.io/chronicle-container/cf_production_stable_windows

This configuration maps the windows C:\data\ directory to the /opt/chronicle/data directory inside the Chronicle container.

6. After you start the forwarder, enter the following command to view the logs on the forwarder and verify a successful connection:

docker logs cfps

Output:

... 2023-10-03 07:19:53 INFO I1003 07:19:53.162835 6544 run_command.go:35] Chronicle forwarder starting 2023-10-03 07:19:53 INFO I1003 07:19:53.235001 6544 monitor.go:65] Starting config monitor

It may take a few seconds for the container to fully initialize.

Check your learning:

Task 3. Send sample logs using the file collector

In this task, you configure a collector to read a file with a metadata label. You then send sample logs using the file collector.

Start by making a sample log file in the data directory that is mounted into the container.

1. Navigate to C:\data:

cd c:\data

2. Start Notepad and create a new file called bind_dns.log.

notepad.exe bind_dns.log

4. Click Yes to create the file.

5. Update bind_dns.log as follows:

• Copy the 2 lines below into the file.
• Change all instances of the date to the current date, keeping the same format.

<14>Oct 03 01:20:00 cjisnew local001 - cjisnew named[1449]: 03-Oct-2023 01:13:33.027 client 1.2.3.229#62127 (Opensys-doorctr.jackson.police): query: Opensys-doorctr.jackson.police IN A + (1.2.3.10) <15>Oct 03 01:20:00 cjisnew local001 - cjisnew named[1449]: 03-Oct-2023 01:13:33.047 error (network unreachable) resolving 'www.update.microsoft.com/A/IN': 2001:500:1::53#53

For example if todays date was November 28 2023 this block would look like:

<14>Nov 28 01:20:00 cjisnew local001 - cjisnew named[1449]: 28-Nov-2023 01:13:33.027 client 1.2.3.229#62127 (Opensys-doorctr.jackson.police): query: Opensys-doorctr.jackson.police IN A + (1.2.3.10) <15>Nov 28 01:20:00 cjisnew local001 - cjisnew named[1449]: 28-Nov-2023 01:13:33.047 error (network unreachable) resolving 'www.update.microsoft.com/A/IN': 2001:500:1::53#53

4. Save the bind_dns.log and close Notepad.

5. Change back to the C:\config directory:

cd c:\config

6. Open chronicle_config.conf in Notepad.

notepad.exe chronicle_config.conf

7. Add the following to the end of the file:

- file: common: metadata: labels: file_collector: windows_chronicle enabled: true data_type: BIND_DNS data_hint: batch_n_seconds: 10 batch_n_bytes: 1048576 file_path: /opt/chronicle/data/bind_dns.log skip_seek_to_end: true poll: true

8. Save the file and close Notepad.

9. Enter the following commands and then press ENTER to stop and delete the cfps container:

docker stop cfps docker rm cfps

10. Start the Docker Container again:

docker run ` --detach ` --name cfps ` --restart=always ` --log-opt max-size=100m ` --log-opt max-file=10 ` --dns="8.8.8.8" ` -p 10514:10514 ` -v C:\config\:C:/opt/chronicle/external ` -v C:\data\:C:/opt/chronicle/data ` gcr.io/chronicle-container/cf_production_stable_windows

10. Check the logs:

docker logs cfps

In the output you should now see that the data from the bind_dns.log file has been uploaded:

... 2023-10-03 08:50:56 INFO I1003 08:50:56.140021 1708 monitor.go:65] Starting config monitor 2023-10-03 08:51:06 INFO I1003 08:51:06.534466 1708 malachite.go:257] Batch (1, BIND_DNS) successfully uploaded.

Check your learning:

Task 4. Install and configure the NXLog Community Edition on Windows

The NXLog Community Edition is a high-performance, multi-platform, log collection solution that offers features such as log parsing, filtering, conversion, and forwarding.

1. Open the Google Chrome browser on the Windows Server and open this link in that browser.

https://nxlog.co/downloads/nxlog-ce#nxlog-community-edition

2. Click on Windows Image on the right side of the screen, click Windows x86-64, then Download. Notice the downloaded installer file: the name starts with nxlog-ce and ends in msi.
3. When you are prompted to Login/Signup, click No thanks, just start my download.
4. Run the installer file to install NXLog in the C:\Program Files\nxlog directory.
5. Follow the installation wizard and accept all defaults.

Do not change the installation directory in this lab as the later steps assume you have deployed NXLog in this directory.

6. Restart the NXLog CE process by entering the following command in the PowerShell terminal: Restart-Service nxlog

Task 5. Send Windows logs using the Windows Event collector with all EVT types in one config file

NXLog CE supports modular configuration files as well as an All-in-One configuration file. For this exercise, we will use the All-In-One configuration file . You can keep using the Powershell terminal for these tasks.

1. Enter the following command in the Powershell terminal to create a new nxlog.conf file in the C:\Program Files\nxlog directory using Notepad. notepad "C:\Program Files\nxlog\nxlog.conf"

Creating or modifying content in the C:\Program Files\nxlog directory requires elevated permissions. Launching Notepad from within the elevated PowerShell terminal ensures you can create and edit the file.

2. Copy the following configuration settings into the nxlog.conf file:

Panic Soft #NoFreeOnExit TRUE define ROOT C:\Program Files\nxlog define CERTDIR %ROOT%\cert define CONFDIR %ROOT%\conf define LOGDIR %ROOT%\data define LOGFILE %LOGDIR%\nxlog.log define CDF localhost LogFile %LOGFILE% define WINEVTLOG_OUTPUT_DESTINATION_ADDRESS %CDF% define WINEVTLOG_OUTPUT_DESTINATION_PORT 10518 define ADCONTEXT_OUTPUT_DESTINATION_ADDRESS %CDF% define ADCONTEXT_OUTPUT_DESTINATION_PORT 10519 define SYSMON_OUTPUT_DESTINATION_ADDRESS %CDF% define SYSMON_OUTPUT_DESTINATION_PORT 10520 define WINDEFAV_OUTPUT_DESTINATION_ADDRESS %CDF% define WINDEFAV_OUTPUT_DESTINATION_PORT 10521 define POWERSHELL_OUTPUT_DESTINATION_ADDRESS %CDF% define POWERSHELL_OUTPUT_DESTINATION_PORT 10522 Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data LogFile %ROOT%\data\nxlog.log <Extension _charconv> Module xm_charconv AutodetectCharsets utf-8, euc-jp, utf-16, utf-32, iso8859-2 </Extension> <Extension json> Module xm_json </Extension> <Extension syslog> Module xm_syslog </Extension> <Input in_powershell> Module im_msvistalog Query <QueryList>\ <Query Id="0">\ <Select Path="Windows PowerShell">*</Select>\ <Select Path="Microsoft-Windows-PowerShell/Operational">*</Select>\ </Query>\ </QueryList> </Input> <Output out_chronicle_powershell> Module om_tcp Host %POWERSHELL_OUTPUT_DESTINATION_ADDRESS% Port %POWERSHELL_OUTPUT_DESTINATION_PORT% Exec $EventTime = integer($EventTime) / 1000000; Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000; Exec $Message = to_json(); to_syslog_bsd(); </Output> <Route powershell_chronicle> Path in_powershell => out_chronicle_powershell </Route> <Input in_defender_av> Module im_msvistalog Query <QueryList>\ <Query Id="0">\ <Select Path="Microsoft-Windows-Windows Defender/Operational">*</Select>\ </Query>\ </QueryList> </Input> <Output out_chronicle_defender_av> Module om_tcp Host %WINDEFAV_OUTPUT_DESTINATION_ADDRESS% Port %WINDEFAV_OUTPUT_DESTINATION_PORT% Exec $EventTime = integer($EventTime) / 1000000; Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000; Exec $Message = to_json(); to_syslog_bsd(); </Output> <Route defender_av_to_chronicle> Path in_defender_av => out_chronicle_defender_av </Route> <Input in_sysmon> Module im_msvistalog Query <QueryList>\ <Query Id="0">\ <Select Path="Microsoft-Windows-Sysmon/Operational">*</Select>\ </Query>\ </QueryList> </Input> <Output out_chronicle_sysmon> Module om_tcp Host %SYSMON_OUTPUT_DESTINATION_ADDRESS% Port %SYSMON_OUTPUT_DESTINATION_PORT% Exec $EventTime = integer($EventTime) / 1000000; Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000; Exec $Message = to_json(); to_syslog_bsd(); </Output> <Route sysmon_to_chronicle> Path in_sysmon => out_chronicle_sysmon </Route> <Input in_default_channels> Module im_msvistalog Query <QueryList>\ <Query Id="0">\ <Select Path="Application">*</Select>\ <Select Path="System">*</Select>\ <Select Path="Security">*</Select>\ <Select Path="Microsoft-Windows-TaskScheduler/Operational">*</Select>\ </Query>\ </QueryList> </Input> <Output out_chronicle_winevtlog> Module om_tcp Host %WINEVTLOG_OUTPUT_DESTINATION_ADDRESS% Port %WINEVTLOG_OUTPUT_DESTINATION_PORT% Exec $EventTime = integer($EventTime) / 1000000; Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000; Exec $Message = to_json(); to_syslog_bsd(); </Output> <Route winevtlog_to_chronicle> Path in_default_channels => out_chronicle_winevtlog </Route> <Input in_adcontext> Module im_file #DirCheckInterval 3600 #PollInterval 3600 File "C:\ADContext\ad_context.json" Exec $Event = convert($raw_event,"UTF-16LE","UTF-8"); if $raw_event == '' drop(); </Input> <Output out_chronicle_adcontext> Module om_tcp Host %ADCONTEXT_OUTPUT_DESTINATION_ADDRESS% Port %ADCONTEXT_OUTPUT_DESTINATION_PORT% </Output> <Route ad_context_to_chronicle> Path in_adcontext => out_chronicle_adcontext </Route>

If you had deployed NXlog to a different installation directory you would have to first line of this configu file to define a different ROOT value.

3. Save the nxlog.conf and close Notepad.

You will now configure the Chronicle forwarder to send the NXlog syslog events to Chronicle.

4. Open chronicle_config.conf in Notepad.

notepad.exe C:\config\chronicle_config.conf

5. Add the following to the end of chronicle_config.conf file to add a listener for the NXlog syslog event data:

- syslog: common: enabled: true data_type: WINEVTLOG batch_n_seconds: 10 batch_n_bytes: 1048576 tcp_address: 0.0.0.0:10518 connection_timeout_sec: 60

6. Save the file chronicle_config.conf and exit Notepad.

7. Restart the NXLog CE process by entering the following command in the PowerShell terminal:

Restart-Service nxlog

9. Enter the following commands and press ENTER to stop and delete the cfps container:

docker stop cfps docker rm cfps

10. Restart the container with the data directory mapping, adding additional port mappings to align with the settings in nxlog.conf:

docker run ` --detach ` --name cfps ` --restart=always ` --log-opt max-size=100m ` --log-opt max-file=10 ` --dns="8.8.8.8" ` -p 10514:10514 ` -p 10515:10515 ` -p 10516:10516 ` -p 10518:10518 ` -v C:\config\:C:/opt/chronicle/external ` -v C:\data\:C:/opt/chronicle/data ` gcr.io/chronicle-container/cf_production_stable_windows

11. Check the docker container logs. docker logs cfps

You should now see Windows event log (WINEVTLOG) batches in the output that look similar to the following:

2024-02-16 00:03:03 INFO I0216 00:03:03.857425 2160 syslog.go:401] Accepting new syslog TCP connection. 2024-02-16 00:03:10 INFO I0216 00:03:10.833999 2160 malachite.go:257] Batch (22, WINEVTLOG) successfully uploaded.

NXLog sends the Windows logs to localhost on port 10518 (from the NX Log CE config file above). And the Chronicle Forwarder is listening on that port to send the logs as WINEVTLOG type to Chronicle (from the config file of the forwarder).

Check your learning:

Task 6. Chronicle forwarder config verification

In order to validate that you have configured Chronicle correctly for this lab you must upload your final chronicle_config.conf file to a Cloud Storage bucket for validation.

1. Run the following command in the PowerShell terminal to copy the chronicle_config.conf file to the Cloud Storage bucket:

gcloud storage cp c:\config\chronicle_config.conf gs://{{{primary_project.startup_script.gcs_bucket_name|project-bucket}}}

Click Check my progress to verify the objective. Verify if the lab is completed successfully.

Congratulations!

You've successfully accomplished the configuration of Chronicle forwarder for Windows on Docker!

Nex steps / Learn more

• Read more about Chronicle in the Chronicle Security Operations documentation.

Google Cloud training and certification

...helps you make the most of Google Cloud technologies. Our classes include technical skills and best practices to help you get up to speed quickly and continue your learning journey. We offer fundamental to advanced level training, with on-demand, live, and virtual options to suit your busy schedule. Certifications help you validate and prove your skill and expertise in Google Cloud technologies.

Manual Last Updated April 19, 2024

Lab Last Tested April 09, 2024

Copyright 2025 Google LLC. All rights reserved. Google and the Google logo are trademarks of Google LLC. All other company and product names may be trademarks of the respective companies with which they are associated.