MBCDN

Dies ist eine alte Version des Dokuments!

---

Winlogbeat ist ein Tool um Windows Eventlogs aufzubereiten und in einen Elasticsearchbzw. Opensearch Index zu speichern. Das Tool erstellt den Index von selbst.

• DC01
• DC02
• EX01
• EX02
• FS03
• FS04
• FW01
• FW02
• FW03
• T-FW01

• AUDIT
• GBI016
• EX01

curl -X GET "https://172.21.0.134:9200/winlogbeat-8.17.4/_search" -u "elastic:fw5XeLo_I0X470yF_XQL" --insecure -H 'Content-Type: application/json' -d '{"query": { "wildcard": { "winlog.event_data.TargetUserName": "SYS*"}}}' | jq -r '.hits.hits[]._source | "\(.agent.name)"'

curl -X GET "https://172.21.0.134:9200/winlogbeat-8.17.4/_search" -u "elastic:fw5XeLo_I0X470yF_XQL" --insecure -H 'Content-Type: application/json' -d '{"query": { "wildcard": { "winlog.event_data.TargetUserName": "SYS*"}}}' | jq -r '.hits.hits[]._source["@timestamp"]'

Im Installationsordner von Winlogbeat findet sich ein ps1 Script.

.\install-service-winlogbeat.ps1

# Diese Konfiguration speichert die Logs aller Server im selben Index
winlogbeat.event_logs:

  - name: Application
    ignore_older: 72h

  - name: System

  - name: Security
    envent_id: 4800, 4801 # nur diese event ids
    event_id: -1000,-1000-2000 # Mit minus davor IDs ausschliessen
    
  - name: Microsoft-Windows-Sysmon/Operational

  - name: Windows PowerShell
    event_id: 400, 403, 600, 800

  - name: Microsoft-Windows-PowerShell/Operational
    event_id: 4103, 4104, 4105, 4106

  - name: ForwardedEvents
    tags: [forwarded]
    
  - name: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
    level: critical, error, warning
    language: 0x0409 # en-US
    processors:
      - drop_event.when.not.or:
      - equals.winlog.event_id: 903
      - equals.winlog.event_id: 1024
      - equals.winlog.event_id: 4624
    tags: ["web"]
    include_xml: true
    provider: # (Get-WinEvent -ListLog Security).ProviderNames
      - Application Error
      - Application Hang
      - Windows Error Reporting
      - EMET
 

  - id: dhcp-server-logs
    xml_query: >
      <QueryList>
        <Query Id="0" Path="DhcpAdminEvents">
          <Select Path="DhcpAdminEvents">*</Select>
          <Select Path="Microsoft-Windows-Dhcp-Server/FilterNotifications">*</Select>
          <Select Path="Microsoft-Windows-Dhcp-Server/Operational">*</Select>
        </Query>
      </QueryList>

# ====================== Elasticsearch template settings =======================

setup.template.settings:
  index.number_of_shards: 1
  #index.codec: best_compression
  #_source.enabled: false
 
 
# ================================== Outputs ===================================
 
# Configure what output to use when sending the data collected by the beat.
 
# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["localhost:9200"]
 
  # Protocol - either `http` (default) or `https`.
  #protocol: "https"
 
  # Authentication credentials - either API key or username/password.
  #api_key: "id:api_key"
  username: "elastic"
  password: "*y_mEkRRJHEBLK7ird=*"
 
  # Pipeline to route events to security, sysmon, or powershell pipelines.
  pipeline: "winlogbeat-%{[agent.version]}-routing"
 
 
# ================================= Processors =================================
processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~