How to consume Windows Event Logs via MiNiFi?

[#1]

The EFM (Edge Flow Manager) makes it super simple to write flows for MiNiFi to execute where ever it may be located (laptops, refineries, phones, OpenShift,etc).  All agents (MiNiFi) are assigned an agentClass.  Once the agent is turned on, it will phone home to EFM for run-time instructions. The run-time instructions are set at the Class level.  Meaning all agents within a class, run the same instruction (flow) set. There can be 0 to many Classes.  In this example, I will capture Windows Security Events via MiNiFi and ship them to NiFi over Site2Site

1. Download MiNiFi MSI and set the classname.  In this example, I set the classname to test6.  This property is set at install time (MSI) or by going directly into minifi.properties. Also, notice the setting nifi.c2.enable=true.  This informs MiNFi that run time flow instructions will be received from EFM.  Start MiNiFi.
   
2. MiNiFi can be configured to send data to multi endpoint (ie Kafka, NiFi, EventHub, etc). In this example, data will be sent to NiFi over S2S.  On NiFi create an input port:
   
3. Capture the port ID. This will be used in EFM later on:
   
4. On EFM, open class test6.  This is where we design the flow for all agents with their class is set to test6:
   
5. To capture Windows events via MiNiFi, add ConsumeWindowsEventLog processor to the canvas:
   
6. Configure the process to pull events.  In this example, MiNiFi will listen for Windows Security Events:
   
7. To send data from MiNiFi to NiFi, add Remote Process Group to the canvas. Provide a NiFi endpoint:
   
8. Connect ConsumeWindowsEventLog processor to the Remote Process Group. Provide the NiFi Input Port ID captured earlier:
   
9. Flow is ready to publish:
   
10. Click on Publish. MiNiFi will phone home at a set interval (nifi.c2.agent.heartbeat.period). Once that occurs, MiNiFi will receive new run time flow instructions.  At that time data will start flowing into NiFi.
     

The EFM makes it super simple to capture Windows events and universally ship anywhere without the ball and chain of most agent/platform designs.