安裝 winlogbeat

https://www.elastic.co/guide/en/beats/winlogbeat/master/winlogbeat-getting-started.html

安裝 1 - 直接到 Elasticsearch

winlogbeat -> ( Elasticsearch -> Kibana )

https://www.elastic.co/guide/en/beats/winlogbeat/master/winlogbeat-configuration.html

步驟一. 下載安裝 winlogbeat

https://www.elastic.co/downloads/beats/winlogbeat

安裝 Winlogbeat 1.3.1 for ELK 4x

(for ELK 5x 版, 安裝 5.0.0)

如果你無法安裝, 請參考

http://go.microsoft.com/fwlink/?LinkID=135170 =>

  https://technet.microsoft.com/library/hh847748.aspx

.\install-service-winlogbeat.ps1

步驟二. 修改 winlogbeat.yml

設定檔

winlogbeat.event_logs:
  - name: Application
  - name: Security
  - name: System

output.elasticsearch:
  hosts:
    - <ELK_IP_NAME>:9200

logging.to_files: true
logging.files:
  path: C:/ProgramData/winlogbeat/Logs
logging.level: info

步驟三. 手動執行 winlogbeat

winlogbeat -c winlogbeat.yml

https://gist.github.com/mingderwang/6111baad5254a7d6888cf9e3024f1e91

winlogbeat.yml 範例,可以在 gist下載

步驟四. 啓動 winlogbeat

Start-Service winlogbeat

安裝 2 - 透過 Logstash

For Logstash usage with Beats, see https://www.elastic.co/guide/en/beats/winlogbeat/master/config-winlogbeat-logstash.html19 and https://www.elastic.co/guide/en/beats/libbeat/master/logstash-installation.html#logstash-setup9.

winlogbeat -> ( Logstash -> Elasticsearch -> Kibana )

testing

PS C:\Program Files\Winlogbeat> Get-EventLog *

  Max(K) Retain OverflowAction        Entries Log
  ------ ------ --------------        ------- ---
  20,480      0 OverwriteAsNeeded       3,024 Application
  20,480      0 OverwriteAsNeeded           0 HardwareEvents
     512      7 OverwriteOlder              0 Internet Explorer
  20,480      0 OverwriteAsNeeded           0 Key Management Service
  20,480      0 OverwriteAsNeeded       5,179 Security
  20,480      0 OverwriteAsNeeded       3,684 System
  15,360      0 OverwriteAsNeeded         157 Windows PowerShell

manually run winlogbeat.exe

PS C:\Program Files\Winlogbeat> ./winlogbeat.exe -c ./winlogbeat.yml

check with your ELK

winlogbeat-*

PC system security logs

安裝過程也被 log 到了