Defensive › Module 7 › Lesson 2
Ship and Collect
Forwarders, agents, and syslog — ship YOUR lab logs to YOUR collector only.
Visual · t16_ship_collect
Ship = forward; collect = store and index. Original Cyberlium.
Opening
Forwarding is a plumbing skill — the ethics line is whose logs you are allowed to pipe.
Windows: Windows Event Forwarding or agent (WEF, NXLog-style literacy). Linux: rsyslog or journald forwarding to remote syslog. Agents may add parsing and buffering. Configure forwarders on $LAB hosts to $LAB collector IP on lab network — never point agents at stranger infrastructure or pull logs from hosts outside RoE. Defenders validate TLS, auth, and firewall rules on the forward path.
1. Forward paths
Syslog UDP/TCP/TLS to collector; WEF subscriptions for Windows Security channel subsets.
Agents add reliability — queue when collector offline briefly.
Command guide
Try these commands — Forward paths
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Elastic ship — https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html rsyslog forwarding — https://www.rsyslog.com/doc/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
journalctl -n 10 --no-pager 2>/dev/null | head -8
curl -sS -X POST http://127.0.0.1:8088/ -H 'Content-Type: application/json' -d '{"message":"cyberlium-lab-test","host":"127.0.0.1"}' -o /dev/null -w "local ingest HTTP %{http_code}
" 2>/dev/null || echo 'Ship sample event to YOUR local collector'Primary tools to practice this lesson: curl, journalctl. Reference sites: Elastic ship (https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html); rsyslog forwarding (https://www.rsyslog.com/doc/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Collector basics
Listener port, storage path, retention policy, access RBAC on search UI.
Lab: one $LAB Linux collector receiving $LAB client syslog — isolated VLAN.
3. Boundary
Forward only logs from hosts in your RoE file. No 'best effort' public Wi-Fi captures.
Encrypt forward path in production patterns — lab may note TLS as requirement.
4. What you ship: ship-and-collect diagram
$LAB forwarder → $LAB collector + TLS/auth note + RoE scope.
5. What you record before the next lesson
Forward path sketch for lab fleet.
6. Wrong vs right: stranger hosts vs YOUR lab hosts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Install forwarder on roommate PC to 'fill the SIEM.'
Right
Name forward methods. Next: time integrity.
Mission: ship and collect sketch
1) Draw $LAB client → collector arrow with protocol. 2) Name one Windows and one Linux forward method. 3) Write NEVER forward stranger logs.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “WEF vs agent tradeoff?”
Knowledge Check
APPLY: rsyslog forward sends:
Multiple choice
Knowledge Check
APPLY: True or False: Forwarding from unauthorized hosts is OK.
True or False
Knowledge Check
APPLY: Collector should have:
Multiple choice