Console
    Start free

    Collect Windows AppLocker logs

    Supported in:

    This document explains how to ingest Windows AppLocker logs to Google Security Operations using Bindplane.

    Windows AppLocker is an application whitelisting feature built into Windows that generates policy enforcement, audit, and application execution logs. The Bindplane agent collects exported Windows AppLocker event log files directly from the local file system.

    Before you begin

    Make sure you have the following prerequisites:

    • A Google SecOps instance
    • Windows Server 2016 or later with observiq-otel-collector service support
    • If running behind a proxy, ensure firewall ports are open per the Bindplane agent requirements
    • Administrator access to Windows endpoints with AppLocker policies configured

    Get Google SecOps ingestion authentication file

    1. Sign in to the Google SecOps console.
    2. Go to SIEM Settings > Collection Agents.

    3. Download the Ingestion Authentication File. Save the file securely on the system where Bindplane will be installed.

    Get Google SecOps customer ID

    1. Sign in to the Google SecOps console.
    2. Go to SIEM Settings > Profile.

    3. Copy and save the Customer IDfrom the Organization Detailssection.

    Install the Bindplane agent

    Install the Bindplane agent on your Windows operating system according to the following instructions.

    Windows installation

    1. Open Command Promptor PowerShellas an administrator.

    2. Run the following command:

        msiexec 
  
 / 
 i 
  
 "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" 
  
 / 
 quiet

    3. Wait for the installation to complete.

    4. Verify the installation by running:

       sc query observiq-otel-collector

    The service should show as RUNNING.

    Additional installation resources

    For additional installation options and troubleshooting, see Bindplane agent installation guide .

    Configure Bindplane agent to ingest logs and send to Google SecOps

    Locate the configuration file

    • Windows:

       notepad "C:\Program Files\observIQ OpenTelemetry Collector\config.yaml"

    Edit the configuration file

    • Replace the entire contents of config.yaml with the following configuration:

        receivers 
 : 
  
 filelog 
 : 
  
 include 
 : 
  
 - 
  
 C:\Logs\applocker\*.evtx 
  
 start_at 
 : 
  
 beginning 
 exporters 
 : 
  
 chronicle/windows_applocker 
 : 
  
 compression 
 : 
  
 gzip 
  
 creds_file_path 
 : 
  
 'C:\Program 
  
 Files\observIQ 
  
 OpenTelemetry 
  
 Collector\ingestion-auth.json' 
  
 customer_id 
 : 
  
 '<customer_id>' 
  
 endpoint 
 : 
  
 malachiteingestion-pa.googleapis.com 
  
 log_type 
 : 
  
 WINDOWS_APPLOCKER 
  
 raw_log_field 
 : 
  
 body 
  
 ingestion_labels 
 : 
  
 env 
 : 
  
 production 
 service 
 : 
  
 pipelines 
 : 
  
 logs/applocker_to_chronicle 
 : 
  
 receivers 
 : 
  
 - 
  
 filelog 
  
 exporters 
 : 
  
 - 
  
 chronicle/windows_applocker

    Configuration parameters

    Replace the following placeholders:

    • Receiver configuration:

      • filelog : The receiver type for collecting log files from disk
      • include : List of file paths to monitor. Set this to the location where you export Windows AppLocker event logs (for example, C:\Logs\applocker\*.evtx )
      • start_at : Set to beginning to read existing logs or end to only read new entries

    • Exporter configuration:

      • windows_applocker : Descriptive name for the exporter
      • creds_file_path : Full path to ingestion authentication file:
        • Windows: C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json
      • <customer_id> : Customer ID from the previous step
      • endpoint : Regional endpoint URL:
        • US: malachiteingestion-pa.googleapis.com
        • Europe: europe-malachiteingestion-pa.googleapis.com
        • Asia: asia-southeast1-malachiteingestion-pa.googleapis.com
        • See Regional Endpoints for complete list
      • WINDOWS_APPLOCKER : Log type exactly as it appears in Chronicle
      • ingestion_labels : Optional labels in YAML format (for example, env: production )

    • Pipeline configuration:

      • applocker_to_chronicle : Descriptive name for the pipeline

    Save the configuration file

    • After editing, save the file:
      • Windows: Click File > Save

    Restart the Bindplane agent to apply the changes

    To restart the Bindplane agent in Windows:

    1. Choose one of the following options:

      • Command Prompt or PowerShell as administrator:
       net stop observiq-otel-collector && net start observiq-otel-collector
      • Services console:
        1. Press Win+R , type services.msc , and press Enter.
        2. Locate observIQ OpenTelemetry Collector.
        3. Right-click and select Restart.

    2. Verify the service is running:

       sc query observiq-otel-collector

    3. Check logs for errors:

        type 
  
 "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"

    Configure Windows AppLocker log export

    Windows AppLocker logs are stored in the Windows Event Log under multiple channels. You need to export these logs to files on disk so the Bindplane agent can collect them.

    1. Create a directory to store the exported log files:

       mkdir C:\Logs\applocker

    2. Export Windows AppLocker event logs using wevtutil :

       wevtutil epl "Microsoft-Windows-AppLocker/EXE and DLL" C:\Logs\applocker\applocker-exedll.evtx 

       wevtutil epl "Microsoft-Windows-AppLocker/MSI and Script" C:\Logs\applocker\applocker-msiscript.evtx 

       wevtutil epl "Microsoft-Windows-AppLocker/Packaged app-Deployment" C:\Logs\applocker\applocker-pkgdeploy.evtx 

       wevtutil epl "Microsoft-Windows-AppLocker/Packaged app-Execution" C:\Logs\applocker\applocker-pkgexec.evtx

    3. (Optional) Schedule regular exports using Windows Task Scheduler:

        $action 
 = 
 New-ScheduledTaskAction 
 -Execute 
 "wevtutil" 
 -Argument 
 'epl "Microsoft-Windows-AppLocker/EXE and DLL" C:\Logs\applocker\applocker-exedll.evtx /ow:true' 
 $trigger 
 = 
 New-ScheduledTaskTrigger 
 -RepetitionInterval 
 ( 
 New-TimeSpan 
 -Hours 
 1 
 ) 
 -Once 
 -At 
 ( 
 Get-Date 
 ) 
 Register-ScheduledTask 
 -Action 
 $action 
 -Trigger 
 $trigger 
 -TaskName 
 "ExportAppLockerLogs" 
 -Description 
 "Export Windows AppLocker logs for Bindplane agent"

    4. Verify that the exported log files are being created at `C:\Logs\applocker`.

    5. Ensure the Bindplane agent include path in config.yaml matches the export directory.

    UDM mapping table

    Log Field UDM Mapping Logic
    event_type
    		 metadata.event_type Type of the event
    EventID
    		 metadata.product_event_type Product-specific event type
    SourceModuleType
    		 observer.application Application that observed the event
    Domain
    		 principal.administrative_domain Administrative domain of the principal
    Hostname
    		 principal.hostname Hostname of the principal
    principal_ip1
    		 principal.ip IP address of the principal
    AccountType
    		 principal.user.attribute.roles Roles associated with the principal user
    AccountName
    		 principal.user.userid User ID of the principal user
    ssdl
    		 security_result.about.labels Labels about the security result
    security_action
    		 security_result.action Action taken in the security result
    message1
    		 security_result.description Description of the security result
    RuleAndFileData.RuleId
    		 security_result.rule_id ID of the security rule
    RuleAndFileData.RuleName, EventID
    		 security_result.rule_name Name of the security rule
    EventType
    		 security_result.severity Severity level of the security result
    RuleAndFileData.PolicyName
    		 security_result.summary Summary of the security result
    ThreadID
    		 security_result.threat_id ID of the threat
    RuleAndFileData.FullFilePath, filePath
    		 target.process.file.full_path Full path of the target process file
    ProcessID, RuleAndFileData.TargetProcessId
    		 target.process.pid Process ID of the target process
    ProviderGuid
    		 target.resource.product_object_id Product object ID of the target resource
    UserID
    		 target.user.userid User ID of the target user
    sourceName
    		 metadata.product_name Name of the product
    		metadata.vendor_name Name of the vendor

    Need more help? Get answers from Community members and Google SecOps professionals.

    Create a Mobile Website
    View Site in Mobile | Classic
    Share by: