- The Devo data analytics platform
- Getting started
- Domain administration
-
Sending data to Devo
-
The Devo In-House Relay
- Installing the Devo Relay
- Configuring the In-House Relay
- Relay migration
- Sending SSL/TLS encrypted events to the Devo relay
- Relay troubleshooting tips (v1.4.2)
-
Event sources
- Unix-like machines
- Windows
- MacOS X
- Cloud services
- Commercial products
- Custom apps
-
Universal Agent
- Pre-integrated query packs
- Data querying in Devo
-
Universal Agent Manager deployment
- Universal Agent Manager - CentOS 7 Deployment
- Universal Agent Manager - CentOS 8 Deployment
- Universal Agent Manager - Debian 9 Deployment
- Universal Agent Manager - Debian 10 Deployment
- Universal Agent Manager - RHEL 7 Deployment
- Universal Agent Manager - RHEL 8 Deployment
- Universal Agent Manager - Ubuntu 18 Deployment
- Universal Agent deployment
- Performance considerations
- Other data collection methods
- Uploading log files
- Devo software
-
The Devo In-House Relay
-
Parsers and collectors
- About Devo tags
- Special Devo tags and data tables
-
List of Devo parsers
- Business & Consumer
- Cloud technologies
- Databases
- Host and Operating Systems
-
Network and application security
- auth.secureauth
- auth.securenvoy
- av.mcafee
- av.sophos
- box.iptables
- edr.cylance
- edr.fireeye.alerts
- edr.minervalabs.events
- edr.paloalto
- endpoint.symantec
- firewall.checkpoint
- firewall.cisco firepower and vpn.cisco
- firewall.fortinet
- firewall.huawei
- firewall.juniper
- firewall.paloalto
- firewall.pfsense
- firewall.sonicwall
- firewall.sophos
- firewall.sophos.xgfirewall
- firewall.stonegate
- firewall.windows
- ids.extrahop
- mail.proofpoint
- nac.aruba
- network.meraki
- network.versa
- network.vmware
- proxy.bluecoat
- proxy.forcepoint
- proxy.squid
- uba.varonis
- vuln.beyondtrust
- vpn.pulsesecure.sa
- Network connectivity
- Web servers
- Technologies supported in CEF syslog format
- Collectors
-
Searching data
- Accessing data tables
-
Building a query
- Data types in Devo
- Build a query in the search window
- Build a query using LINQ
- Working with JSON objects in data tables
- Subqueries
-
Operations reference
-
Aggregation operations
- Average (avg)
- Count (count)
- First (first)
- First not null (nnfirst)
- HyperLogLog++ (hllpp)
- HyperLogLog++ Count Estimation (hllppcount)
- Last (last)
- Last not null (nnlast)
- Maximum (max)
- Median / 2nd quartile / Percentile 50 (median)
- Minimum (min)
- Non-null average (nnavg)
- Non-null standard deviation (biased) (nnstddev)
- Non-null standard deviation (unbiased) (nnustddev)
- Non-null variance (biased) (nnvar)
- Non-null variance (unbiased) (nnuvar)
- Percentile 10 (percentile10)
- Percentile 25 / 1st quartile (percentile25)
- Percentile 5 (percentile5)
- Percentile 75 / 3rd quartile (percentile75)
- Percentile 90 (percentile90)
- Percentile 95 (percentile95)
- Standard deviation (biased) (stddev)
- Standard deviation (unbiased) (ustddev)
- Sum (sum)
- Sum Square (sum2)
- Variance (biased) (var)
- Variance (unbiased) (uvar)
-
Arithmetic group
- Absolute value (abs)
- Addition, sum, plus / Concatenation (add, +)
- Ceiling (ceil)
- Cube root (cbrt)
- Division (div, \)
- Division remainder (rem, %)
- Floor (floor)
- Modulo (mod, %%)
- Multiplication, product (mul, *)
- Power (pow)
- Real division (rdiv, /)
- Rounding (round)
- Sign (signum)
- Square root (sqrt)
- Subtraction, minus / Additive inverse (sub, -)
-
Conversion group
- Duration (duration)
- Format date (formatdate)
- From base16, b16, hex (from16)
- From base64, b64 (from64)
- From UTF8 (fromutf8)
- From Z85, base85 (fromz85)
- Human size (humanSize)
- Make byte array (mkboxar)
- Parse date (parsedate)
- Regular expression, regexp (re)
- Template (template)
- Timestamp (timestamp)
- To base16, b16, hex (to16)
- To base64, b64, hex (to64)
- To BigInt (bigint)
- To boolean (bool)
- To Float (float)
- To image (image)
- To Int (int)
- To IPv4 (ip4)
- To IPv4 net (net4)
- To IPv6 (ip6)
- To IPv6 compatible (compatible)
- To IPv6 mapped (mapped)
- To IPv6 net (net6)
- To IPv6 translated (translated)
- To MAC address (mac)
- To string (str)
- To string (stringify)
- To UTF8 (toutf8)
- To Z85, base85 (toz85)
- Cryptography group
- Date group
- Flow group
- General group
-
Geolocation group
- Coordinates distance (distance)
- Geocoord (geocoord)
- Geographic coordinate system (coordsystem)
- Geohash (geohash)
- Geohash string (geohashstr)
- Geolocated Accuracy Radius with MaxMind GeoIP2 (mm2accuracyradius)
- Geolocated ASN (mmasn)
- Geolocated ASN with MaxMind GeoIP2 (mm2asn)
- Geolocated AS Organization Name with MaxMind GeoIP2 (mm2asorg)
- Geolocated AS owner (mmasowner)
- Geolocated City (mmcity)
- Geolocated City with MaxMind GeoIP2 (mm2city)
- Geolocated Connection Speed (mmspeed)
- Geolocated connection type with MaxMind GeoIP2 (mm2con)
- Geolocated Coordinates (mmcoordinates)
- Geolocated coordinates with MaxMind GeoIP2 (mm2coordinates)
- Geolocated Country (mmcountry)
- Geolocated Country with MaxMind GeoIP2 (mm2country)
- Geolocated ISP (mmisp)
- Geolocated ISP name with MaxMind GeoIP2 (mm2isp)
- Geolocated Latitude (mmlatitude)
- Geolocated Latitude with MaxMind GeoIP2 (mm2latitude)
- Geolocated Level 1 Subdivision with MaxMind GeoIP2 (mm2subdivision1)
- Geolocated Level 2 Subdivision with MaxMind GeoIP2 (mm2subdivision2)
- Geolocated Longitude (mmlongitude)
- Geolocated Longitude with MaxMind GeoIP2 (mm2longitude)
- Geolocated Organization (mmorg)
- Geolocated organization name with MaxMind GeoIP2 (mm2org)
- Geolocated Postal Code (mmpostalcode)
- Geolocated Postal Code with MaxMind GeoIP2 (mm2postalcode)
- Geolocated Region (mmregion)
- Geolocated Region Name (mmregionname)
- ISO-3166-1 Continent Alpha-2 Code (continentalpha2)
- ISO-3166-1 Continent Name (continentname)
- ISO-3166-1 Country Alpha-2 Code (countryalpha2)
- ISO-3166-1 Country Alpha-2 Continent (countrycontinent)
- ISO-3166-1 Country Alpha-3 Code (countryalpha3)
- ISO-3166-1 Country Latitude (countrylatitude)
- ISO-3166-1 Country Longitude (countrylongitude)
- ISO-3166-1 Country Name (countryname)
- Latitude (latitude)
- Latitude and longitude coordinates (latlon)
- Longitude (longitude)
- Parse geocoord format (parsegeo)
- Represent geocoord format (reprgeo)
- Round coordinates (gridlatlon)
- JSON group
- Logic group
-
Mathematical group
- Arc cosine (acos)
- Arc sine (asin)
- Arc tangent (atan)
- Bitwise AND (band, &)
- Bitwise left shift (lshift, <<)
- Bitwise NOT (bnot, ~)
- Bitwise OR (bor, |)
- Bitwise right shift (rshift, >>)
- Bitwise unsigned right shift (urshift, >>>)
- Bitwise XOR (bxor, ^)
- Cosine (cos)
- e (mathematical constant) (e)
- Exponential: base e (exp)
- Hyperbolic cosine (cosh)
- Hyperbolic sine (sinh)
- Hyperbolic tangent (tanh)
- Logarithm: base 2 (log2)
- Logarithm: base 10 (log10)
- Logarithm: natural / arbitrary base (log)
- Pi (mathematical constant) (pi)
- Sine (sin)
- Tangent (tan)
- Meta Analysis group
- Name group
-
Network group
- HTTP Status Description (httpstatusdescription)
- HTTP Status Type (httpstatustype)
- IP Protocol (ipprotocol)
- IP Reputation Score (reputationscore)
- IP Reputation Tags (reputation)
- IPv4 legal use (purpose)
- IPv6 host number (host)
- IPv6 routing number (routing)
- Is IPv4 (ipip4)
- Is Private IPv4 (isprivate)
- Is Public IPv4 (ispublic)
- Squid Black Lists Flags (sbl)
- Order group
-
Packet group
- Ethernet destination MAC address (etherdst)
- Ethernet payload (etherpayload)
- Ethernet source MAC address (ethersrc)
- Ethernet status (etherstatus)
- Ethernet tag (ethertag)
- EtherType (ethertype)
- Has Ethernet frame (hasether)
- Has IPv4 datagram (hasip4)
- Has TCP segment (hastcp)
- Has UDP datagram (hasudp)
- IPv4 destination address (ip4dst)
- IPv4 differentiated services (ip4ds)
- IPv4 explicit congestion notification (ip4ecn)
- IPv4 flags (ip4flags)
- IPv4 fragment offset (ip4fragment)
- IPv4 header checksum (ip4cs)
- IPv4 header length (ip4hl)
- IPv4 identification (ip4ident)
- IPv4 payload (ip4payload)
- IPv4 protocol (ip4proto)
- IPv4 source address (ip4src)
- IPv4 status (ip4status)
- IPv4 time to live (ip4ttl)
- IPv4 total length (ip4len)
- IPv4 type of service (ip4tos)
- TCP ACK (tcpack)
- TCP checksum (tcpcs)
- TCP destination port (tcpdst)
- TCP flags (tcpflags)
- TCP header length (tcphl)
- TCP payload (tcppayload)
- TCP sequence number (tcpseq)
- TCP source port (tcpsrc)
- TCP status (tcpstatus)
- TCP urgent pointer (tcpurg)
- TCP window size (tcpwin)
- UDP checksum (udpcs)
- UDP destination port (udpdst)
- UDP length (udplen)
- UDP payload (udppayload)
- UDP source port (udpsrc)
- UDP status (udpstatus)
- Statistical group
-
String group
- Contains (has, ->)
- Contains - case insensitive (weakhas)
- Contains tokens (toktains)
- Contains tokens - case insensitive (weaktoktains)
- Edit distance: Damerau (damerau)
- Edit distance: Hamming (hamming)
- Edit distance: Levenshtein (levenshtein)
- Edit distance: OSA (osa)
- Ends with (endswith)
- Format number (formatnumber)
- Hostname public suffix (publicsuffix)
- Hostname root domain (rootdomain)
- Hostname root prefix (rootprefix)
- Hostname root suffix (rootsuffix)
- Hostname subdomains (subdomain)
- Hostname top level domain (topleveldomain)
- Is empty (isempty)
- Is in (`in`, <-)
- Is in - case insensitive (weakin)
- Length (length)
- Locate (locate)
- Lower case (lower)
- Matches (matches, ~)
- Peek (peek)
- Replace all (replaceall)
- Replace first (replace)
- Shannon entropy (shannonentropy)
- Split (split)
- Split regexp (splitre)
- Starts with (startswith)
- Substitute (subs)
- Substitute all (subsall)
- Substring (substring)
- Trim both sides (trim)
- Trim the left side (ltrim)
- Trim the right side (rtrim)
- Upper case (upper)
-
Web group
- Absolute URI (absoluteuri)
- Opaque URI (opaqueuri)
- URI authority (uriauthority)
- URI fragment (urifragment)
- URI host (urihost)
- URI path (uripath)
- URI port (uriport)
- URI query (uriquery)
- URI scheme (urischeme)
- URI ssp (urissp)
- URI user (uriuser)
- URL decode (urldecode)
- User Agent Company (uacompany)
- User Agent Company URL (uacompanyurl)
- User Agent Device Icon (uadeviceicon)
- User Agent Device Information URL (uadeviceinfourl)
- User Agent Device Type (uadevicetype)
- User Agent Family (uafamily)
- User Agent Icon (uaicon)
- User Agent Information URL (uainfourl)
- User Agent is Robot (uaisrobot)
- User Agent Name (uaname)
- User Agent OS Company (uaoscompany)
- User Agent OS Company URL (uaoscompanyurl)
- User Agent OS Family (uaosfamily)
- User Agent OS Icon (uaosicon)
- User Agent OS Name (uaosname)
- User Agent OS URL (uaosurl)
- User Agent Type (uatype)
- User Agent URL (uaurl)
- User Agent Version (uaversion)
-
Aggregation operations
-
Working in the search window
-
Generate charts
- Affinity chord diagram
- Availability timeline
- Bipartite chord diagram
- Bubble chart
- Chart aggregation
- Custom date chart aggregation
- Flame graph
- Flat world map by coordinates
- Flat world map by country
- Google animated heat map
- Google area map
- Google heat map
- Graph diagram
- Histogram
- Pew Pew map
- Pie chart
- Pie layered chart
- Punch card
- Robust Random Cut Forest chart
- Sankey diagram
- Scatter plot
- Time heatmap
- Triple exponential chart
- Voronoi treemap
- Data enrichment
- Setting up a data table
- Advanced data operations
- Use case: eCommerce behavior analysis
-
Generate charts
- Managing your queries
- Best practices for data search
- Monitoring tables
- Activeboards
-
Dashboards
- Create a new dashboard
-
Working with dashboard widgets
- Availability timeline widget
- Chord diagram widget
- Circle world map widget
- Color key value widget
- Color world map widget
- Column chart widget
- Comparative chart widget
- Funnel widget
- Gauge meter widget
- Google heatmap widget
- Heat calendar widget
- Line chart widget
- Monitoring widget
- Pie chart widget
- Punch card widget
- Sectored pie chart widget
- Table widget
- Time heatmap widget
- Tree diagram widget
- Voronoi tree widget
- Configuring and sharing dashboards
- Alerts and notifications
- Panels
- Applications
- Tools
- Flow
- Social Intelligence
- API reference
- Release notes
Devo Agent for Windows
Overview
The Devo Agent for Windows installs the following components:
ProxyServerContainer | Enables communication for sending events to the Devo In-house Relay or directly to the Devo Cloud. |
---|---|
MagicEvent | Monitors the Windows Event Log. Also enables the remote monitoring of Windows systems using WMI (Windows Machine Instrumentation). For more information about WMI, see WMI interface. |
MagicLog | Monitors log files on the Windows machine. |
MonitorService | Monitors the machine's system performance. This is a component that runs in the background and requires no specific configuration. |
The Snare agent can collect the events in the Windows Event Logs and send them to Devo using the connection configured by the ProxyServerContainer. This is optional and not included in the Devo Agent installation package. These logs can be sent to Devo using the box.win_snare tag.
This article covers the following topics:
A note about process base priority
The default installation directory is C:\Program Files (x86)\DevoAgents. All the configuration files can be found in this directory.
When opening the MagicEvent.Settings.config, MagicLog.Settings.config or ProxyServerContainer.Settings.config files, the base priority of the processes can be found in the following section of the file:
<!-- PROCESS START -->
<add key="StartOptions" value="B"/>
The Start options value can be:
- “B” - This is the default for all agent processes. Starts the process with priority set as below normal. This setting is recommended when using MagicLog to send log files from critical and high-load Windows servers. The setting will affect the sending rate and small delays might occur during peak load times. No data will be discarded.
- “N” - Starts the process with priority set as normal. This setting is recommended when events need to reach the repository as near real-time as possible.
To check the current value, look for the priority in the process details shown in the task manager.
Before you begin
The Devo Agent requires .NET Framework 4.6 or later.
You must uninstall any previous versions of the Devo Agent from your system before installing a more recent version.
Watch this 5-minute video tutorial to get an overview of this process.
Installing the Devo Agent for Windows
Download the Devo Agent for your region:
Region Devo Agent Version USA DevoAgents.exe v2.11.0.2 Europe DevoAgents.exe v2.11.0.2 - Start the wizard using the executable MSI or EXE file. In the welcome screen, click Next to start the process.
First you need to configure the ProxyServerContainer component, which will establish a connection with the Devo endpoint of your choice; either the Devo relay or the Devo Cloud. The example below will send events over a secure channel directly to the Devo Cloud.
This table lists and describes the fields in this page. Click Next when you finish.
Listening Port
The port that the ProxyServerContainer listens on. We recommend using the default port 10010.
Udp Listening Port
The port used for sending untagged data using Snare. We recommend using the default port 11011.
Sending Ip Address
The remote IP Address/Hostname where events should be sent. For events sent through the In-house Relay, this will be the IP Address of the relay. If sending events directly to the Devo Cloud, use the hostname of the cloud for your region:
Europe: collector-eu.devo.io
USA: collector-us.devo.io
Spain: collector-es.devo.io
Sending Port
The remote port where the data will be sent.
For events to be sent through the In-house Relay, this will be a listening port on the relay. Use 13000 if the events are already tagged correctly. Use 13002 if you need the Devo Relay to apply the box.win tag to the events.
If the events are already tagged and you want to send them directly to the Devo Cloud, use port 443.
If you do not enable SSL secure sending, go to Administration → Relays in the Devo web application and check which port is assigned to the account. The IP address used to send non-secure data should be also authorized by the user. The authorization is also done on the Relay configuration page previously specified.
Compress Type
Select either None or GZipStream. We do not recommend using compression.
Sending Secure
Select this check box to enable SSL secure sending.
If you select this check box, click the Certificate... button to enter the API Key and API Secret of your Devo domain. You can find these using the Devo web applications in Administration → Credentials.
Certificate Subject Distinguished Name
This is the distinguished name of the X.509 certificate used for authenticating the connection. Choose the one in which CN matches the name of your domain.
Store Name
The directory path where the certificates are stored. We recommend selecting My.
Store Location
This is either the LocalMachine or CurrentUser certificate store used for the certificates. We recommend using LocalMachine.
Next, you configure the MagicEvent component for monitoring Windows Event Logs. Here you can identify the specific logs to monitor.
This table lists and describes the fields in this page. Click Next when you finish.Polling Interval (sec) The frequency in seconds that MagicEvent will check for updates in the log files. Max. Degree of Parallelism The number of processes to be polled by MagicEvent in parallel. A great number of processes will result in a negative impact on performance. Sending Port The ProxyServerContainer listening port. We recommend the default port 10010. Sending Ip Address The ProxyServerContainer's IP address on the localhost. We recommend the default 127.0.0.1. Sender Tag The tag to identify the sending machine. This will always be box.win for the Event Log data. Machine List File The directory path and file where the machine list is stored. Usually, this is c:\machines.xml. If changed, the file needs to be created. Hide Passwords Select this check box to encrypt the machine list passwords. We recommend you do this. Select the Add... button to add specific Windows Event Logs to the list of files to monitor. The Edit Machine window appears.
This table lists and describes the fields in this page.
Local Computer Select this box if the machine is located on the current machine. When selected, the Domain, User, and Password fields are deactivated. Machine The name of the machine to be added. Domain The domain name of the machine. User The name of a user with access permissions for Windows events on the machine. Password The user's password. Event Logs This area lists the event groups to monitor. Add them using the Event Log and Query fields below. Event Log Select the event log to be added. Tag Define a new tag for each of the sources added, which will be the tables where the logs will be sent. We recommend to add the box.win tag for all the events. Query Optionally enter a query in xpath language and select Add. For example, if you only want to send events with EventID equal to 903, you can use this script in the Query field: System/EventID=903 When your list of Event Logs is complete, click Accept to return to the MagicEvent window. Repeat if you need to add any more machines, then click Next.
To access a remote machine using MagicEvent, the WMI interface must be activated and a user must be created with permissions over performance monitoring and event monitoring user groups.
Now, you configure MagicLog to monitor files on the local machine.
This table lists and describes the fields in this page.
Polling Interval The frequency in seconds that MagicLog will check for updates in the log files.
Max. Degree Of Parallelism The number of processes to be polled by MagicLog in parallel. A great number of processes will result in a negative impact on performance.
Once finished, select the Add... button to add a new folder to monitor.
The Add Folder window appears.
This table lists and describes the fields in this page. Once finished, select the Accept button. Repeat if you need to add any more folders to monitor, then click Next.
Name
Assign a name for the sending configuration.
Folder Path
The path where the files(s) are sent.
File Pattern
Specify the file extension (*.log, *.csv or *.*).
File Format
Select TEXT (normal ASCII format), EVTX (Windows event file exportation format) or NEWTEXT (to support Unicode files better).
Search Option
To send events only from the log files located in the actual directory specified in Folder Path or should all possible subdirectories be checked for log files as well.
Destination IP
The IP address where events should be sent. This should be the ProxyServerContainer so use the default localhost 127.0.0.1
Port
The sending port destination. We recommend the default port 10010
Protocol
Select either TCP or UDP. We recommend using TCP.
Facility
Specify a facility number for the sending process.
Tag
The Devo tag that identifies the log source being monitored.
Ignore Lines
Here you can indicate if any specific lines should be ignored from sending.
Groups (Regex) Here you can define a regex to be applied to each line. For instance, you may want to remove some data within the event. Select Groups Here you can configure how to work with the groups in the output. Delete When Finished
Select this box to delete the event from the original log file once it's been sent.
Delete If Older Than
Number of days to wait before deleting events from the log file.
Select the checkboxes of the components you want to start right away, then click Finish.
Modifying the agent's configuration
Once installed and running, you can make modifications to the configuration of the agent's components by re-launching the MagicConfigApp.exe file. In the final step of the wizard, you must select the checkbox for each component you have modified in order to restart the service(s) and put the changes into effect.
.