2019-05-16 23:33:51 +02:00
|
|
|
title: Logstash Windows common log sources
|
2019-04-23 00:54:10 +02:00
|
|
|
order: 20
|
2019-05-20 01:00:33 +02:00
|
|
|
backends:
|
|
|
|
|
- es-qs
|
|
|
|
|
- es-dsl
|
2020-02-24 23:20:48 +01:00
|
|
|
- es-rule
|
2019-05-20 01:00:33 +02:00
|
|
|
- kibana
|
|
|
|
|
- xpack-watcher
|
|
|
|
|
- elastalert
|
2019-05-27 17:11:59 +02:00
|
|
|
- elastalert-dsl
|
2020-05-08 10:04:59 +02:00
|
|
|
- ee-outliers
|
2017-03-12 23:12:21 +01:00
|
|
|
logsources:
|
|
|
|
|
windows:
|
|
|
|
|
product: windows
|
|
|
|
|
index: logstash-windows-*
|
|
|
|
|
windows-application:
|
|
|
|
|
product: windows
|
|
|
|
|
service: application
|
|
|
|
|
conditions:
|
2019-06-11 13:15:43 +02:00
|
|
|
Channel: Application
|
2017-03-12 23:12:21 +01:00
|
|
|
windows-security:
|
|
|
|
|
product: windows
|
|
|
|
|
service: security
|
|
|
|
|
conditions:
|
2019-06-11 13:15:43 +02:00
|
|
|
Channel: Security
|
2017-03-14 23:22:32 +01:00
|
|
|
windows-sysmon:
|
|
|
|
|
product: windows
|
|
|
|
|
service: sysmon
|
|
|
|
|
conditions:
|
2019-06-11 13:15:43 +02:00
|
|
|
Channel: Microsoft-Windows-Sysmon
|
2017-05-08 13:09:17 +02:00
|
|
|
windows-dns-server:
|
|
|
|
|
product: windows
|
|
|
|
|
service: dns-server
|
|
|
|
|
conditions:
|
2019-06-11 13:15:43 +02:00
|
|
|
Channel: 'DNS Server'
|
2017-11-09 08:42:58 +01:00
|
|
|
windows-driver-framework:
|
|
|
|
|
product: windows
|
|
|
|
|
service: driver-framework
|
|
|
|
|
conditions:
|
2019-06-11 13:15:43 +02:00
|
|
|
Channel: 'Microsoft-Windows-DriverFrameworks-UserMode/Operational'
|
2019-02-05 14:35:16 +01:00
|
|
|
windows-dhcp:
|
|
|
|
|
product: windows
|
|
|
|
|
service: dhcp
|
2019-05-27 17:11:59 +02:00
|
|
|
conditions:
|
2019-06-11 13:15:43 +02:00
|
|
|
Channel: 'Microsoft-Windows-DHCP-Server/Operational'
|
2020-06-28 10:55:32 +02:00
|
|
|
windows-defender:
|
|
|
|
|
product: windows
|
|
|
|
|
service: windefend
|
|
|
|
|
conditions:
|
|
|
|
|
Channel: 'Microsoft-Windows-Windows Defender/Operational'
|
2020-07-02 23:20:36 +02:00
|
|
|
windows-ntlm:
|
|
|
|
|
product: windows
|
|
|
|
|
service: ntlm
|
|
|
|
|
conditions:
|
|
|
|
|
Channel: 'Microsoft-Windows-NTLM/Operational'
|
2020-07-13 20:48:06 +00:00
|
|
|
windows-applocker:
|
|
|
|
|
product: windows
|
|
|
|
|
service: applocker
|
|
|
|
|
conditions:
|
|
|
|
|
Channel:
|
|
|
|
|
- 'Microsoft-Windows-AppLocker/MSI and Script'
|
|
|
|
|
- 'Microsoft-Windows-AppLocker/EXE and DLL'
|
|
|
|
|
- 'Microsoft-Windows-AppLocker/Packaged app-Deployment'
|
|
|
|
|
- 'Microsoft-Windows-AppLocker/Packaged app-Execution'
|
2017-10-23 00:05:12 +02:00
|
|
|
defaultindex: logstash-*
|
