Implement Centralized Log Collection from Endpoints Using Agents

Business Scenario

You are a Junior SOC Analyst at CyberSecure Solutions. The organisation has multiple Windows and Linux systems, and the security team wants all endpoint logs in one central monitoring platform.

Your task is to install monitoring agents on test endpoints, connect them to the SIEM, and verify that logs are being collected centrally.

 

Pre-Lab Preparation

Git Pull

git pull origin branchName

Topic: Log Management and Analysis

  • Log collection and log analysis

 

Objective

Understand how endpoint logs reach the central SIEM.

Identify the following components:

​

Endpoint

1

Agent

2

SIEM Server

3

Log Storage

4

Task 1: Understand the Log Collection Architecture 

SOC Analyst

5

Example

Expected Output

 

Activity

Students can explain how logs travel from an endpoint to the SIEM.

Objective

Install a monitoring agent on the test endpoint.

Start the Windows/Linux test VM.

1

Download the appropriate SIEM agent.

2

Install the agent.

3

During configuration, provide:

4

Sudden large amounts of file activity.

5

Task 2: Install the Agent

  • SIEM server address

  • Agent name

  • Registration information, if required

Expected Output

 

The agent is installed and running on the test endpoint.

 

Objective

Register the endpoint with the central monitoring server.

Open the SIEM dashboard.

1

Navigate to the Agents/Endpoints section.

2

Locate the test endpoint.

3

  • Agent name

  • IP address

  • Operating system

  • Connection status

Task 3: Connect the Endpoint to the SIEM 

Confirm that its status is Active/Connected.

4

Record:

5

  • Agent name

  • IP address

  • Operating system

  • Connection status

Expected Output

 

The endpoint appears as an active agent in the SIEM.

 

 

Objective

Verify that endpoint logs are being sent to the central system.

Task 4: Collect Endpoint Logs

Generate simple test activities on the endpoint:

1

  • Successful login.

  • Failed login.

  • File creation.

  • File deletion.

  • Service start/stop.

Open the SIEM dashboard.

2

Search for the generated events.

3

Example

Verify that the events came from the correct endpoint.

4

Expected Output

 

Activity

Students can see endpoint events in the central SIEM.

Objective

Understand how centralised logs can be used for monitoring.

Select one collected event.

1

Review:

2

  • Timestamp

  • Hostname

  • Username

  • Event type

  • Source

  • Severity

Determine whether the event is normal or suspicious.

3

Task 5: Analyze the Collected Logs

Record your findings.

4

Expected Output

 

Activity

Students analyze an endpoint event using centralized SIEM data.

Objective

Understand common reasons why logs may not appear.

If logs are not being received, check:

Task 6: Troubleshoot Log Collection

Is the agent service running?

1

Is the endpoint connected to the network?

2

Is the SIEM server reachable?

3

Is the agent correctly registered?

4

Is the required firewall/network communication allowed?

5

Check the agent logs for errors.

6

Restart the agent if required.

7

Verify log collection again.

8

Expected Output

 

The endpoint successfully communicates with the SIEM and sends logs.

 

Task 7: Document the Implementation 

Objective

Create a basic centralised logging report.

Record:

 

FieldExample
Agent NameTEST-PC01
OSWindows
IP Address192.168.1.20
SIEM Server192.168.1.10
Agent StatusActive
Logs ReceivedYes
Log TypesAuthentication/System
StatusSuccessfully Configured

Example Finding

Endpoint: TEST-PC01

 

Implementation:

A SIEM agent was installed and connected to the

central monitoring server.

 

Verification:

The endpoint successfully sent authentication

and system events to the SIEM.

 

Status:

Centralized log collection successfully implemented.

Example Finding

Endpoint: TEST-PC01

 

Implementation:

A SIEM agent was installed and connected to the

central monitoring server.

 

Verification:

The endpoint successfully sent authentication

and system events to the SIEM.

 

Status:

Centralized log collection successfully implemented.

Expected Output

 

Click Here for the Output

 

Great job!

After completing this lab, students will be able to explain centralised log collection, understand the role of SIEM agents, install and configure an endpoint agent, connect endpoints to a central SIEM, verify log collection, analyse centralised endpoint logs, and troubleshoot basic agent connectivity issues.

Checkpoint

   Git Push

git push origin branchName

Next-Lab Preparation

Topic: Log Management and Analysis

  • Log collection and log analysis

 

SOC 13 - Implement Centralized Log Collection from Endpoints Using Agents

By Content ITV

SOC 13 - Implement Centralized Log Collection from Endpoints Using Agents

  • 37

More from Content ITV