The HTTP Receiver component of the Network Services service is a light-weight web server which accepts incoming POST submissions from remote endpoints via the HTTPS protocol. Data received from remote endpoints is saved in temporary files which can be monitored by the EventSentry agent and imported into the EventSentry database as structured data (see diagram below).
HTTPS
The TCP port of the receiver can be customized and set to any valid TCP port, the default port is 8443. To activate the HTTP receiver, simply check the "Enable HTTP Receiver" check box.
TLS
Automatically creates a self-signed certificate file the first time the feature is enabled to facility TLS communication. Creates the following files:
•%SYSTEMROOT%\system32\eventsentry\secure\es_network_svc_http.pfx
•%SYSTEMROOT%\system32\eventsentry\secure\es_network_svc_http.pem (public certificate for distribution)
The public PEM file can be copied to remote devices that require this file in order to trust the self-signed certificate file.
Filename
All received data is written to the specified filename(s). To avoid all data being written to the same file, variables can be used to generate dynamic file names. The following variables are supported (case sensitive):
Variable Name |
Runtime Value |
Example |
$IPADDRESS |
IP address of sender |
168_1_1_99 |
$AUTHID |
Auth ID associated with authorization key |
THKV8RM3L |
$UNIXTIME |
Unix Timestamp |
1759373903 |
$REMOTEID |
IP address and port of sender |
168_1_1_99-4675 |
$YEAR, $MONTH, $DAY |
Current year, month and/or day |
2025, 11, 27 |
$HOUR, $MINUTE, $SECOND |
Current hour, minute and/or second |
23, 12, 58 |
The default file name is %SYSTEMROOT%\system32\eventsentry\temp\networksvc\networksvchttp_$AUTHID_$IPADDRESS_$YEAR-$MONTH-$DAY_$HOUR_$MINUTE.json.
|
IMPORTANT Old files will be automatically deleted based on the auto-delete settings. |
Authorization Keys / Tokens
The HTTP receiver will only accept POST requests which include a listed authorization token in the HTTP header. Authorization tokens are generated by clicking the + button and always include an ID.
Authorization tokens are passed in the "Authorization" field of the HTTP header (similar to most other online services) in the following format:
Authorization: Bearer <AUTHTOKEN>
The authentication ID, which is generated for every authorization token, can be referenced in the file name (see above) with the $AUTHID variable. When multiple senders with different log/json formats submit data to the HTTP Receiver, then it's recommended to assign the same authentication token to senders with the same log format. This ensures that each temporary file has only one log format, making it possible to associate log file(s) and definitions with the respective temporary file.
Authorized IP Addresses / Networks
For enhanced security the HTTP Receiver can be configured to only accept packets from certain IP addresses and/or networks. Host names are not allowed in the list, only IP addresses can be specified.
IP addresses can be entered with or without specifying the subnet bits. For example, to only add two servers with the IP addresses 184.23.22.11 and 184.23.22.43, simply add those two IP addresses to the list.
To authorize a whole subnet, for example the IP addresses 184.23.22.1 - 184.23.22.254, add 184.23.22.0/24. To only allow the range of 184.23.22.128 - 184.23.22.254 then specify 184.23.22.128/25.
