Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question. Don’t forget to select tags to help index your topic!
1. Describe your incident:
2. Describe your environment:
OS Information:
Ubuntu 22.04.3 LTS
Package Version:
5.1
Hi!
I am little confused about setting up the Winbeatlog. I read the documentation and now I have setup the Graylog Sidecare. I have installed the sidecare on my Windows server. Then I created a confiuration file for Winlogbeat for windows and changed the IP address pointing to my Graylog.
Then I selected the WinlogtBeat under Log Collector and edit it and assign my Graylog IP to it and pressed Update collector.
In the Administration section I can see my Winlogbeat is Running fine and I can see the messages under Overview.
I want to only receive security related event id so I just disabled the below in both the collector and configuration.
- name: Application
- name: System
Is this the right way to do it?
Also I dont have to install Winlogbeat on the server itself or I have to install the Winlogbeat installer on the server?
I understand it can be a bit confusing as there are a lot of moving parts.
To help clarify:
Both winlogbeat and filebeat are included with the Windows Graylog Sidecar install and do not need to be installed separately.
Graylog sidecar will control these “collectors” via the graylog UI and you do not need to edit any .yml files locally on the device where sidecar is installed
Sidecar configuration in graylog:
Log Collectors are a configuration that defines what binary (such as winlogbeat.exe) and what command that sidecar executes to start collecting that data.
Examples of differently collectors: filebeat: winlogbeat, nxlog
Configurations specify exactly what the log collector will collect such as a specific text file or specific windows event log
It says here that you should change your config on the device where its installed.
" Once finished, you can change or configure your sidecar.yml file, which should be located in C:\\Program Files\\Graylog\\sidecar\\sidecar.yml"
That file is only settings for the sidecar agent, the most common reason to edit it would be to update the API key or url of your Graylog server, or change tags assigned to that sidecar agent. Most of the time you will edit the configs in the Graylog UI. You can assign a config to as many machines as you want, you only need to make another config when you want to assign a different config to a machine because you need to collect different logs.
If you are talking about the example winlogbeat config yes, BUT that config will only work if you deploy it via sidecar, if you copy that right into the winlogbeat yaml file you will get errors.
Active Directory Monitoring: User account created, A user account was enabled, An attempt was made to change the password of an account, A user account was disabled,A user account was changed, A user account was locked out,A user account was unlocked
name: Security
event_id: 4720-4727
level: info
ignore_older: 48h
provider:
Microsoft-Windows-Security-Auditing
Active directory Monitoring Group:A user was added to a privileged global group, A user was added to a privileged local group, A user was added to a privileged universal group, A privileged local group was modified, A privileged global group was modified, A privileged universal group was modified
Thank you this is very helpful! My apologies, after doing some research it would appear there were some breaking changes (possibly?) introduced around winlogbeat 8.7 and later. This makes sense because we (graylog) have just updated sidecar to use winlogbeat 8.9.0 (previously we used 7.11.1).
That thread I linked above has the workaround but i’ll save you the clickthrough and tell you the fix is to add an id attribute to the config like this:
winlogbeat.event_logs:
# Account login: Successful, Failed, logged off, loggon using explicit credentials
- name: Security
id: account_login
event_id: 4616, 4624, 4625, 4634, 4647, 4648
level: info
ignore_older: 48h
provider:
- Microsoft-Windows-Security-Auditing
# Active Directory Monitoring: User account created, A user account was enabled, An attempt was made to change the password of an account, A user account was disabled,A user account was changed, A user account was locked out,A user account was unlocked
- name: Security
id: ad_mon_user_created
event_id: 4720-4727
level: info
ignore_older: 48h
provider:
- Microsoft-Windows-Security-Auditing
