Windows 10/11 & Windows Server Security Log

the NEW Marketplace Content Pack
1

Download from Github
View on GitHub
Open Issue

This content Pack is only intended for Windows Security Monitoring.
If you noticed some data about security that is not parsed or missing fields, you can open an issue and I will update the Content Pack.

Tested with Windows 10/11 and Windows Server 2022 and Graylog 5.2.2.

The Content Pack should be compatible with all Graylog 5.X version.

Note this was built without extractors, only pipeline rules.

Includes

  • Input (Beats/TCP/5044)
  • Stream (Filebeat & Winlogbeat)
  • Pipeline Rules w/ stages
  • Lookup table + Data adapter + data cache
  • Dashboards

Not included

Hard files that need to be downloaded, see info

Requirements

  • Graylog 5.2.0
  • Sidecar API Token Created
  • Graylog Sidecar Agent 1.5.0
  • Winlogbeat & Filebeat 7.12.1
  • Winlogbeat Security & Powershell Module
  • Edit Windows-ALL-Security-Content-Pack.json before uploading it !

I worked hard to share this with the community, I hope it will suits your needs :wink:
PM me if you encounter any issue.

Note
I dropped many Events on the winlogbeat configuration that are not needed for space optimization, adjust to your needs.

Log size estimation: 130 MB/Agents/day

  • 30 MB/Agents/day for filebeat
  • 100MB/Agents/day for winlogbeat
2

@s0p4L1N awesome thanks :+1:

4

Hello,

I followed the whole procedure, except that the Graylog version is version 6.1.
I have a lot of errors regarding the date format:

OpenSearchException[OpenSearch exception [type=mapper_parsing_exception, reason=failed to parse field [winlog_event_data_param1] of type [date] in document with id ‘ed623730-e3b4-11ef-8ed6-00155d14dc1c’. Preview of field’s value: ‘Service de dĂ©ploiement AppX (AppXSVC)’]]; nested: OpenSearchException[OpenSearch exception [type=illegal_argument_exception, reason=failed to parse date field [Service de dĂ©ploiement AppX (AppXSVC)] with format [strict_date_optional_time||epoch_millis]]]; nested: OpenSearchException[OpenSearch exception [type=date_time_parse_exception, reason=Failed to parse with all enclosed parsers]];

Do you have any idea?

5

I will try to test with the latest Graylog version and update the content pack.
I will keep you update, but it is weird that it can’t parse this field which I assume is from PowerShell event, but maybe because it contain some simple quote with double brackets ?

6

Hello,

Yes it may be a quote problem, I will test Wednesday when I will be there.
Have you checked if it works on a version 6 of Graylog at your place?

Sorry for my bad English, I am French :wink:

Have a good weekend

1 Like
7

Salut Fabrice, je te répond en français comme je suis Français aussi :wink:
J’ai pu testĂ© en rĂ©important le content pack sur la version 6.1.5 et je n’ai pas d’erreur particuliĂšre.

J’ai testĂ© avec Graylog 6.1.5, Datanode 6.1 (fork d’opensearch fait par Graylog)

contact moi par message privé si tu veux, on peut regarder ensemble

8

Salut :slight_smile:

Je ne trouve pas comment envoyer un message privé sur ce forum, je me demande si il ne faut pas avoir un minimum de réponse publique pour avoir droit aux PM.

DĂ©jĂ  c’est rassurant que ça fonctionne correctement sur un Graylog rĂ©cent, je suis en pleine dĂ©couverte de Graylog, je fonctionne sur Opensearch, je devrais dĂ©jĂ  essayer de passer sur Datanode aussi. C’est peut ĂȘtre un manque de droit qui ne laisse pas le Sidecar de Graylog fonctionner normalement, il faut aussi que je cherche de ce cotĂ© lĂ .

D’ailleurs avec les nouvelles version de Graylog, faut il encore remplacer les Ă©xĂ©cutable de Filebeat et Winlogbeat ?

En tout cas je tiens Ă  te remercier pour ton content pack, j’ai testĂ© Illuminate, avec les packs pour la sĂ©curitĂ© Windows, pour une solution pro, elle est moins bonne que la tienne qui est une solution “faite maison” :wink:

Je vais encore tester de mon coté sans lùcher et je te dirais les nouvelles.

Bonne journée, à bientÎt.

9

Il faut savoir que Sidecar est lĂ  juste pour t’aider Ă  dĂ©ployer tes configuration Winlogbeat / NXLogs vers tes agents installĂ©s sur tes endpoints, il n’interagis pas avec Opensearch.

Tout dépend de comment tu as installé ta stack graylog / opensearch effectivement.

J’ai testĂ© la derniĂšre version de Winlogbeat (7.17.27) par exemple et ça fonctionne parfaitement pour les journaux Windows, avec la 8.17.1, le problĂšme est qu’il n’est plus possible d’utiliser les modules (security, powershell ou sysmon) car tu es obligĂ© de passer par Elasticsearch et les Ingest Nodes Pipeline pour faire fonctionner les modules.

Je te recommande d’installer Winlogbeat sans passer par la gestion de Sidecar.

Tu trouvera les configurations ici et j’ai mis Ă  jour ma doc sur github: Graylog_Content_Pack_Windows_Security/beats_config at main · s0p4L1n3/Graylog_Content_Pack_Windows_Security · GitHub

Je dois retravailler sur le content pack, j’ai mis l’ancien dans archives.

10

First off thanks for all the work you’ve put into this. I’ve installed it and most seems to working however I have an issue with the file monitoring dashboard; no events are populating. I notice when i edit the main query it’s only looking for the “windowsshare” tag. Where is this tag applied? I only see references to “filesystem” in the winlogbeat.yml.

Also are the js scripts included in the winlogbeat zips supposed to run? In the script files themselves they specify they’re for beats 8.

11

Hello,

Sorry for the inconvenience, I’m currently writing / updating the content pack with winlgobeat/filebeat version 8 and modules with JavaScript are not loaded anymore.

I will try to provide you with the winlogbeat 7 config if needed

12

No need for apologies; you’re doing great work!

I found the yml configs for 7 your posted and made all the required changes. I’m just confused over the js scripts in the modules folder. I downloaded the beats zips directly from the beats site and even though the version of the exes is 7 the scripts still state they are for beats 8.

13

I found a backup of my old README on my computer: Graylog_Content_Pack_Windows_Security/archives/OLD_README.md at main · s0p4L1n3/Graylog_Content_Pack_Windows_Security · GitHub

Keep in check I will provide soon with new features on my new content pack !

No more sidecar.
SIGMA RULES
MITRE & ATTACK framework
ALERTING
Dashboards improved