Support for Syslog/CEF output about chainsaw

[fscc-jamesd]

Hi @Richard1611

Unfortunately chainsaw is not designed to centralise logs, there are better tools that can achieve this. An approach you might want to consider is to enable windows event forwarding (WEF) and then run chainsaw against the logs which have been collected in a central location.

Unfortunately there appears to be an issue with the underlying rust evtx library which means that forwarded events currently can't be processed (as discussed in #25 ) but once this is fixed the solution above should work for you.

[georgethemarmot]

Hi @Richard1611
WEF is efficient to centralize, but the forwarded event file if big (eg > 20GB) it will be really slow to process or filter.
Also to split the collection evtx file by source you have to change and recompile the event collection dll and MS documentation is missing.
I suggest to look into SIEM solutions.
https://github.com/wazuh/wazuh is a free solution if you have time to fiddle around with configurations.