mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-07 17:58:52 +00:00
44 lines
969 B
YAML
44 lines
969 B
YAML
title: Logstash Windows common log sources
|
|
order: 20
|
|
backends:
|
|
- es-qs
|
|
- es-dsl
|
|
- kibana
|
|
- xpack-watcher
|
|
- elastalert
|
|
logsources:
|
|
windows:
|
|
product: windows
|
|
index: logstash-windows-*
|
|
windows-application:
|
|
product: windows
|
|
service: application
|
|
conditions:
|
|
EventLog: Application
|
|
windows-security:
|
|
product: windows
|
|
service: security
|
|
conditions:
|
|
EventLog: Security
|
|
windows-sysmon:
|
|
product: windows
|
|
service: sysmon
|
|
conditions:
|
|
EventLog: Microsoft-Windows-Sysmon
|
|
windows-dns-server:
|
|
product: windows
|
|
service: dns-server
|
|
conditions:
|
|
EventLog: 'DNS Server'
|
|
windows-driver-framework:
|
|
product: windows
|
|
service: driver-framework
|
|
conditions:
|
|
source: 'Microsoft-Windows-DriverFrameworks-UserMode/Operational'
|
|
windows-dhcp:
|
|
product: windows
|
|
service: dhcp
|
|
conditions:
|
|
source: 'Microsoft-Windows-DHCP-Server/Operational'
|
|
defaultindex: logstash-*
|