2020-06-25 11:59:51 +00:00
|
|
|
title: ELK Windows Indices and Mappings
|
2020-05-08 10:41:52 +00:00
|
|
|
logsources:
|
|
|
|
|
windows:
|
|
|
|
|
product: windows
|
|
|
|
|
index: logstash-windows-*
|
|
|
|
|
windows-application:
|
|
|
|
|
product: windows
|
|
|
|
|
service: application
|
|
|
|
|
conditions:
|
|
|
|
|
EventLog: Application
|
|
|
|
|
windows-security:
|
|
|
|
|
product: windows
|
|
|
|
|
service: security
|
|
|
|
|
conditions:
|
|
|
|
|
EventLog: Security
|
|
|
|
|
windows-sysmon:
|
|
|
|
|
product: windows
|
|
|
|
|
service: sysmon
|
|
|
|
|
conditions:
|
|
|
|
|
EventLog: Microsoft-Windows-Sysmon
|
|
|
|
|
windows-dns-server:
|
|
|
|
|
product: windows
|
|
|
|
|
service: dns-server
|
|
|
|
|
conditions:
|
|
|
|
|
EventLog: 'DNS Server'
|
|
|
|
|
windows-driver-framework:
|
|
|
|
|
product: windows
|
|
|
|
|
service: driver-framework
|
|
|
|
|
conditions:
|
2020-07-02 21:20:36 +00:00
|
|
|
EventLog: 'Microsoft-Windows-DriverFrameworks-UserMode/Operational'
|
|
|
|
|
windows-ntlm:
|
|
|
|
|
product: windows
|
|
|
|
|
service: ntlm
|
|
|
|
|
conditions:
|
|
|
|
|
EventLog: 'Microsoft-Windows-NTLM/Operational'
|
2020-07-13 20:32:03 +00:00
|
|
|
windows-applocker:
|
|
|
|
|
product: windows
|
|
|
|
|
service: applocker
|
|
|
|
|
conditions:
|
|
|
|
|
EventLog:
|
|
|
|
|
- 'Microsoft-Windows-AppLocker/MSI and Script'
|
|
|
|
|
- 'Microsoft-Windows-AppLocker/EXE and DLL'
|
|
|
|
|
- 'Microsoft-Windows-AppLocker/Packaged app-Deployment'
|
|
|
|
|
- 'Microsoft-Windows-AppLocker/Packaged app-Execution'
|
2020-05-08 10:41:52 +00:00
|
|
|
defaultindex: logstash-*
|
