Centralize Windows Log Collection with Cribl WEC

Agent-less mechanism to collect windows data

Collecting Windows logs across hundreds or thousands of servers has always been a challenge, especially when enterprises prefer an agent-less architecture.

In this blog, we simplify the entire process by walking through how to centralize Windows event logs securely using Cribl WEF, an agent-less collection mechanism that leverages HTTPS and mutual TLS (mTLS) authentication. You’ll learn how to build a self-signed certificate authority, generate server and client certificates with both Server and Client Authentication EKUs, and configure Cribl to receive logs directly from Windows endpoints without deploying any agents.

Without Internal CA — Self Signing

If you have an existing internal CA, you skip creating CA Certificate, CA Key and All CSR signing should be done by your internal CA.

CA Certificate:

• Creating CA Key & Certificate

# Create Cribl CA Key
openssl genrsa -out criblca.key 4096

# Create Cribl Certificate Authority
openssl req -x509 -new -nodes -key criblca.key -sha256 -days 3650 -out criblca.pem -subj "/C=AE/ST=Dubai/L=Dubai/O=UAE/OU=IT/CN=OpsCalibre"

“-days” : For the sake of testing I have given 3650 days, modify them according to your requirement

“-subj” : Modify according to your environment. CN can be any name here no hard limits.

Files Available at this Stage

Client Certificate:

• Generate a client CSR, sign it with the custom CA created in “CA Certificate”.

# Create WEF Client Private Key and Client CSR
openssl req -new -newkey rsa:2048 -nodes -keyout cribl_wef_client.key -out cribl_wef_client.csr \
  -subj "/C=AE/ST=Dubai/L=Dubai/O=YourOrg/OU=IT/CN=clauhvmcribl.cyberlavender.local" \
  -addext "subjectAltName=DNS:clauhvmcribl.cyberlavender.local,DNS:clauhvmcribl"

“-subj” : Modify according to your environment. CN & SAN matching your WEC Server hostname.

Create a file named ext_client.cnf

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
# Add SANs that match your host(s)
subjectAltName = @alt_names

[ alt_names ]
DNS.1 = clauhvmcribl.cyberlavender.local
DNS.2 = clauhvmcribl
IP.1  = 192.168.55.21

“DNS.1, DNS.2, IP.1” : Modify them according to your environment

Use the above file to sign the Client CSR

# Sign the Client CSR
openssl x509 -req   -in cribl_wef_client.csr   -CA criblca.pem -CAkey criblca.key -CAcreateserial   -out cribl_wef_client.crt   -days 825 -sha256   -extfile ext_client.cnf -extensions v3_req

Files Available at this Stage

Ensure the Client certificate created contains appropriate SAN and Extended Key Usage roles

# Validate EKU
openssl x509 -in cribl_wef_client.crt -noout -text | sed -n '/X509v3 Extended Key Usage/,+2p'

# Validate SAN
openssl x509 -in cribl_wef_client.crt -noout -text | sed -n '/Subject Alternative Name/,+5p'

Client Certificate Attributes Validation

# Export Client Certificate & Key as a PFX file

openssl pkcs12 -export   -out cribl_wef_client.pfx   -inkey cribl_wef_client.key   -in cribl_wef_client.crt   -certfile criblca.pem

Files Available at this Stage

Move the PFX file to windows Client(s)

• Under “Personal Store” you will have the Client certificate bundle (cert& key)
• Ensure the Imported Client Certificate bundle facilitates access to “Network Service” which is essential in mTLS communication

• Under Trusted Root Certificate you should have the CA file which we created

Apply Windows GPO as highlighted here so you windows Server will configure the WEC server details and forward logs.

Server Certificate:

• Generate a server CSR, sign it with the custom CA created in “CA Certificate”.

openssl req -new -newkey rsa:2048 -nodes -keyout cribl_wef_server.key -out cribl_wef_server.csr \
  -subj "/C=AE/ST=Dubai/L=Dubai/O=YourOrg/OU=IT/CN=clauhvmcribl.cyberlavender.local" \
  -addext "subjectAltName=DNS:clauhvmcribl.cyberlavender.local,DNS:clauhvmcribl"

Use the same “.cnf” file to sign the Server CSR

# Sign the Server CSR
openssl x509 -req   -in cribl_wef_server.csr   -CA criblca.pem -CAkey criblca.key -CAcreateserial   -out cribl_wef_server.crt   -days 825 -sha256   -extfile ext_client.cnf -extensions v3_req

Files Available at this Stage

Now cat cribl_wef_server.crt, cribl_wef_server.key & criblca.key file and keep the content ready, we will use them in Cribl Source configuration.

WEF Certificate Configuration

• Certificate: cribl_wef_server.crt contents
• Private Key: cribl_wef_server.key contents
• CA Certificate: criblca.key contents

Once you saved the certificate refer this cert in Source configuration

Source Configuration

Under “Subscriptions” you can choose which events to capture from all your Windows Servers. For the sake of demo I am capturing all Security and PowerShell logs

Capture Security & PowerShell Logs

Say if you wanna capture only selected event ID’s, you can construct a query something like below,

*[System[EventID=4624 or EventID=4625 or EventID=4688 or EventID=4648 or EventID=4634 or    EventID=4740 or EventID=4720 or EventID=4726 or EventID=4722 or EventID=4723 or    EventID=4724 or EventID=4725 or EventID=4732 or EventID=4733 or EventID=4756 or    EventID=4672 or EventID=4769 or EventID=4771 or EventID=4776 or EventID=5140 ]]

Once configured and source configuration is saved, you will see logs flowing from your Windows Servers.

If no logs seen, for troubleshooting check the below,

• Ensure your Cribl server interface is receiving logs on port 5986

sudo tcpdump -nnvA port 5986

• Check from any one of the Windows Server Log Viewer for Error

Event Viewer → Applications and Service Logs → Microsoft → Windows → Eventlog-ForwardingPlugin → Operational

I welcome your discussion and feedback on this topic. Feel free to reach me via email at “kaviarasan one one nine five at gmail dot com” or connect on LinkedIn.

References

Cribl WEC Cribl WEC Blog