{"id":275,"date":"2019-12-24T01:01:28","date_gmt":"2019-12-24T01:01:28","guid":{"rendered":"http:\/\/snehpatel.com\/?p=275"},"modified":"2019-12-24T01:01:28","modified_gmt":"2019-12-24T01:01:28","slug":"winlogbeat-and-sysmon-setup-integration-with-elk","status":"publish","type":"post","link":"https:\/\/snehpatel.com\/index.php\/2019\/12\/24\/winlogbeat-and-sysmon-setup-integration-with-elk\/","title":{"rendered":"Winlogbeat and Sysmon setup. Integration with ELK"},"content":{"rendered":"\n<p>This post is all about windows logging with winlogbeat and sysmon in place to collect all the important logs possible. <\/p>\n\n\n\n<p>Without getting into details about the installation of ELK stack I will get started with the installation of services and configuring the server to process that logs. Here is the link for installation script for ELK stack:- <a href=\"http:\/\/snehpatel.com\/index.php\/shell-script-for-elk-installation\/\">http:\/\/snehpatel.com\/index.php\/shell-script-for-elk-installation\/<\/a><\/p>\n\n\n\n<p>First, let&#8217;s start with setting up the server for getting logs. To be specific adding configuration file for logstash, as we will be sending logs straight to logstash.<\/p>\n\n\n\n<p>Note: All configuration tested on Centos. Make sure to set proper iptables settings to allow the port to get logs. <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Create new file in folder called \/etc\/logstash\/conf.d\/<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>nano \/etc\/logstash\/conf.d\/windowslog.conf<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li>Note: Make sure you have the config path included in the logstash configuration.<\/li><\/ul>\n\n\n\n<ul class=\"wp-block-list\"><li>Include the following configuration and save the file.<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>input {\n  beats {\n    port => 5044\n  }\n}\n\n# The filter part of this file is commented out to indicate that it\n# is optional.\n# filter {\n#\n# }\n\noutput {\n  elasticsearch {\n    hosts => \"localhost:9200\"\n    manage_template => false\n    index => \"%{&#91;@metadata]&#91;beat]}-%{&#91;@metadata]&#91;version]}-%{+YYYY.MM.dd}\"\n  }\n}<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li>Restart the logstash services.<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl restart logstash<\/code><\/pre>\n\n\n\n<p>Now its time for windows client settings. Let&#8217;s start with the installation of sysmon. Sysmon is a windows tool to enable event logging. <\/p>\n\n\n\n<p>Follow the steps to enable sysmon on your windows client.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Download sysmon from the following link : <a href=\"https:\/\/docs.microsoft.com\/en-us\/sysinternals\/downloads\/sysmon\">https:\/\/docs.microsoft.com\/en-us\/sysinternals\/downloads\/sysmon<\/a><\/li><li>Unzip the package and move it to C:\\Program Files<\/li><li>Rename the folder to &#8220;sysmon&#8221;<\/li><li>Open the command prompt with administrator privileges and go to that directory<\/li><li>Enter the following command to install sysmon <\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>Sysmon.exe -i -n -accepteula<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li>Check-in services to make sure the service is running<\/li><\/ul>\n\n\n\n<p>Now let&#8217;s go through with installation on winlogbeat services<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Download winlogbeat from the following link: <a href=\"https:\/\/www.elastic.co\/downloads\/beats\/winlogbeat\">https:\/\/www.elastic.co\/downloads\/beats\/winlogbeat<\/a><\/li><li>Unzip it and rename the folder to &#8220;winlogbeat&#8221;, now move it to following location C:\\Program Files<\/li><li>Open Powershell with administrator privileges and change directory to the winlogbeat folder<\/li><li>And run the following command :<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>.\\install-service-winlogbeat.ps1<\/code><\/pre>\n\n\n\n<p>NOTE:- execution of the script will be restricted in PowerShell by default. Below are the following commands that will help.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ExecutionPolicy -list<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>Set-ExecutionPolicy -Scope \"CurrentUser\" -ExecutionPolicy \"RemoteSigned\"<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li>Now open winlogbeat.yml in a text editor and remove all configuration.<\/li><li>Copy following configuration<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>winlogbeat.event_logs:\n  - name: Application\n    ignore_older: 72h\n\n  - name: System\n\n  - name: Security\n    processors:\n      - script:\n          lang: javascript\n          id: security\n          file: ${path.home}\/module\/security\/config\/winlogbeat-security.js\n\n  - name: Microsoft-Windows-Sysmon\/Operational\n    processors:\n      - script:\n          lang: javascript\n          id: sysmon\n          file: ${path.home}\/module\/sysmon\/config\/winlogbeat-sysmon.js\n\n\nsetup.template.settings:\n  index.number_of_shards: 1\n\nsetup.dashboards.enabled: true\n\nsetup.kibana:\n\n  host: \"172.16.1.250:5601\"\n\noutput.logstash:\n  hosts: &#91;\"172.16.1.250:5044\"]\n\nprocessors:\n  - add_host_metadata: ~\n  - add_cloud_metadata: ~\n  - add_docker_metadata: ~<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li>Make sure to change the IP addresses of kibana and logstash<\/li><li>Now go to services and restart sysmon and winlogbeat service<\/li><\/ul>\n\n\n\n<p>There we go now, you will see the dashboard and index automatically added on to kibana<\/p>\n\n\n\n<p>References:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>https:\/\/silentbreaksecurity.com\/windows-events-sysmon-elk\/<\/li><li>http:\/\/snehpatel.com\/index.php\/shell-script-for-elk-installation\/<\/li><li>https:\/\/community.sophos.com\/kb\/en-us\/134205<\/li><li>https:\/\/www.elastic.co\/guide\/en\/beats\/winlogbeat\/current\/winlogbeat-configuration.html<\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>This post is all about windows logging with winlogbeat and sysmon in place to collect all the important logs possible. Without getting into details about the installation of ELK stack I will get started with the installation of services and configuring the server to process that logs. Here is the link for installation script for &#8230; <a title=\"Winlogbeat and Sysmon setup. Integration with ELK\" class=\"read-more\" href=\"https:\/\/snehpatel.com\/index.php\/2019\/12\/24\/winlogbeat-and-sysmon-setup-integration-with-elk\/\" aria-label=\"Read more about Winlogbeat and Sysmon setup. Integration with ELK\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[14,3,6,8,9,10],"tags":[28,51,54,55],"class_list":["post-275","post","type-post","status-publish","format-standard","hentry","category-elk","category-logging","category-opensource","category-siem","category-systme","category-windows","tag-elk","tag-system","tag-windows","tag-winlogbeat"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Winlogbeat and Sysmon setup. Integration with ELK - Sneh Patel<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/snehpatel.com\/index.php\/2019\/12\/24\/winlogbeat-and-sysmon-setup-integration-with-elk\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Winlogbeat and Sysmon setup. Integration with ELK - Sneh Patel\" \/>\n<meta property=\"og:description\" content=\"This post is all about windows logging with winlogbeat and sysmon in place to collect all the important logs possible. Without getting into details about the installation of ELK stack I will get started with the installation of services and configuring the server to process that logs. Here is the link for installation script for ... Read more\" \/>\n<meta property=\"og:url\" content=\"https:\/\/snehpatel.com\/index.php\/2019\/12\/24\/winlogbeat-and-sysmon-setup-integration-with-elk\/\" \/>\n<meta property=\"og:site_name\" content=\"Sneh Patel\" \/>\n<meta property=\"article:published_time\" content=\"2019-12-24T01:01:28+00:00\" \/>\n<meta name=\"author\" content=\"Sneh Patel\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Sneh Patel\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/snehpatel.com\\\/index.php\\\/2019\\\/12\\\/24\\\/winlogbeat-and-sysmon-setup-integration-with-elk\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/snehpatel.com\\\/index.php\\\/2019\\\/12\\\/24\\\/winlogbeat-and-sysmon-setup-integration-with-elk\\\/\"},\"author\":{\"name\":\"Sneh Patel\",\"@id\":\"https:\\\/\\\/snehpatel.com\\\/#\\\/schema\\\/person\\\/a39105bc63f7e11a0e07b12a4c3dda73\"},\"headline\":\"Winlogbeat and Sysmon setup. Integration with ELK\",\"datePublished\":\"2019-12-24T01:01:28+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/snehpatel.com\\\/index.php\\\/2019\\\/12\\\/24\\\/winlogbeat-and-sysmon-setup-integration-with-elk\\\/\"},\"wordCount\":401,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/snehpatel.com\\\/#\\\/schema\\\/person\\\/a39105bc63f7e11a0e07b12a4c3dda73\"},\"keywords\":[\"ELK\",\"System\",\"Windows\",\"Winlogbeat\"],\"articleSection\":[\"ELK\",\"Logging\",\"opensource\",\"SIEM\",\"System\",\"Windows\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/snehpatel.com\\\/index.php\\\/2019\\\/12\\\/24\\\/winlogbeat-and-sysmon-setup-integration-with-elk\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/snehpatel.com\\\/index.php\\\/2019\\\/12\\\/24\\\/winlogbeat-and-sysmon-setup-integration-with-elk\\\/\",\"url\":\"https:\\\/\\\/snehpatel.com\\\/index.php\\\/2019\\\/12\\\/24\\\/winlogbeat-and-sysmon-setup-integration-with-elk\\\/\",\"name\":\"Winlogbeat and Sysmon setup. Integration with ELK - Sneh Patel\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/snehpatel.com\\\/#website\"},\"datePublished\":\"2019-12-24T01:01:28+00:00\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/snehpatel.com\\\/index.php\\\/2019\\\/12\\\/24\\\/winlogbeat-and-sysmon-setup-integration-with-elk\\\/\"]}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/snehpatel.com\\\/#website\",\"url\":\"https:\\\/\\\/snehpatel.com\\\/\",\"name\":\"Sneh Patel\",\"description\":\"Cyber Security Blog\",\"publisher\":{\"@id\":\"https:\\\/\\\/snehpatel.com\\\/#\\\/schema\\\/person\\\/a39105bc63f7e11a0e07b12a4c3dda73\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/snehpatel.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/snehpatel.com\\\/#\\\/schema\\\/person\\\/a39105bc63f7e11a0e07b12a4c3dda73\",\"name\":\"Sneh Patel\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i0.wp.com\\\/snehpatel.com\\\/wp-content\\\/uploads\\\/2020\\\/09\\\/cropped-Slide4-1.jpg?fit=672%2C222&ssl=1\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/snehpatel.com\\\/wp-content\\\/uploads\\\/2020\\\/09\\\/cropped-Slide4-1.jpg?fit=672%2C222&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/snehpatel.com\\\/wp-content\\\/uploads\\\/2020\\\/09\\\/cropped-Slide4-1.jpg?fit=672%2C222&ssl=1\",\"width\":672,\"height\":222,\"caption\":\"Sneh Patel\"},\"logo\":{\"@id\":\"https:\\\/\\\/i0.wp.com\\\/snehpatel.com\\\/wp-content\\\/uploads\\\/2020\\\/09\\\/cropped-Slide4-1.jpg?fit=672%2C222&ssl=1\"},\"sameAs\":[\"http:\\\/\\\/snehpatel.com\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Winlogbeat and Sysmon setup. Integration with ELK - Sneh Patel","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/snehpatel.com\/index.php\/2019\/12\/24\/winlogbeat-and-sysmon-setup-integration-with-elk\/","og_locale":"en_US","og_type":"article","og_title":"Winlogbeat and Sysmon setup. Integration with ELK - Sneh Patel","og_description":"This post is all about windows logging with winlogbeat and sysmon in place to collect all the important logs possible. Without getting into details about the installation of ELK stack I will get started with the installation of services and configuring the server to process that logs. Here is the link for installation script for ... Read more","og_url":"https:\/\/snehpatel.com\/index.php\/2019\/12\/24\/winlogbeat-and-sysmon-setup-integration-with-elk\/","og_site_name":"Sneh Patel","article_published_time":"2019-12-24T01:01:28+00:00","author":"Sneh Patel","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Sneh Patel","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/snehpatel.com\/index.php\/2019\/12\/24\/winlogbeat-and-sysmon-setup-integration-with-elk\/#article","isPartOf":{"@id":"https:\/\/snehpatel.com\/index.php\/2019\/12\/24\/winlogbeat-and-sysmon-setup-integration-with-elk\/"},"author":{"name":"Sneh Patel","@id":"https:\/\/snehpatel.com\/#\/schema\/person\/a39105bc63f7e11a0e07b12a4c3dda73"},"headline":"Winlogbeat and Sysmon setup. Integration with ELK","datePublished":"2019-12-24T01:01:28+00:00","mainEntityOfPage":{"@id":"https:\/\/snehpatel.com\/index.php\/2019\/12\/24\/winlogbeat-and-sysmon-setup-integration-with-elk\/"},"wordCount":401,"commentCount":0,"publisher":{"@id":"https:\/\/snehpatel.com\/#\/schema\/person\/a39105bc63f7e11a0e07b12a4c3dda73"},"keywords":["ELK","System","Windows","Winlogbeat"],"articleSection":["ELK","Logging","opensource","SIEM","System","Windows"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/snehpatel.com\/index.php\/2019\/12\/24\/winlogbeat-and-sysmon-setup-integration-with-elk\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/snehpatel.com\/index.php\/2019\/12\/24\/winlogbeat-and-sysmon-setup-integration-with-elk\/","url":"https:\/\/snehpatel.com\/index.php\/2019\/12\/24\/winlogbeat-and-sysmon-setup-integration-with-elk\/","name":"Winlogbeat and Sysmon setup. Integration with ELK - Sneh Patel","isPartOf":{"@id":"https:\/\/snehpatel.com\/#website"},"datePublished":"2019-12-24T01:01:28+00:00","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/snehpatel.com\/index.php\/2019\/12\/24\/winlogbeat-and-sysmon-setup-integration-with-elk\/"]}]},{"@type":"WebSite","@id":"https:\/\/snehpatel.com\/#website","url":"https:\/\/snehpatel.com\/","name":"Sneh Patel","description":"Cyber Security Blog","publisher":{"@id":"https:\/\/snehpatel.com\/#\/schema\/person\/a39105bc63f7e11a0e07b12a4c3dda73"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/snehpatel.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/snehpatel.com\/#\/schema\/person\/a39105bc63f7e11a0e07b12a4c3dda73","name":"Sneh Patel","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i0.wp.com\/snehpatel.com\/wp-content\/uploads\/2020\/09\/cropped-Slide4-1.jpg?fit=672%2C222&ssl=1","url":"https:\/\/i0.wp.com\/snehpatel.com\/wp-content\/uploads\/2020\/09\/cropped-Slide4-1.jpg?fit=672%2C222&ssl=1","contentUrl":"https:\/\/i0.wp.com\/snehpatel.com\/wp-content\/uploads\/2020\/09\/cropped-Slide4-1.jpg?fit=672%2C222&ssl=1","width":672,"height":222,"caption":"Sneh Patel"},"logo":{"@id":"https:\/\/i0.wp.com\/snehpatel.com\/wp-content\/uploads\/2020\/09\/cropped-Slide4-1.jpg?fit=672%2C222&ssl=1"},"sameAs":["http:\/\/snehpatel.com"]}]}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/posts\/275","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/comments?post=275"}],"version-history":[{"count":0,"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/posts\/275\/revisions"}],"wp:attachment":[{"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/media?parent=275"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/categories?post=275"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/tags?post=275"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}