# Active Directory logs and mapping to ECS (I am stumped)

**URL:** <https://discuss.elastic.co/t/active-directory-logs-and-mapping-to-ecs-i-am-stumped/203321>\
**Category:** SIEM\
**Tags:** ecs-elastic-common-schema\
**Created:** [October 12, 2019, 6:08pm UTC](https://discuss.elastic.co/t/active-directory-logs-and-mapping-to-ecs-i-am-stumped/203321 "2019-10-12T18:08:04Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![iukea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iukea/32/49083_2.png) [@iukea](https://discuss.elastic.co/u/iukea)\
**Post date:** [October 12, 2019, 6:08pm UTC](https://discuss.elastic.co/t/active-directory-logs-and-mapping-to-ecs-i-am-stumped/203321/1 "2019-10-12T18:08:04Z")

</div>

Hello guys/girls,

Need some words of wisdom on ECS and on Active Directory logs.

I am currently logging a Windows server 2012 Domain controller and used to flowing guide (provided by ElasticSearch)  
- [https://www.elastic.co/blog/monitoring-windows-logons-with-winlogbeat](https://www.elastic.co/blog/monitoring-windows-logons-with-winlogbeat)

- [https://www.elastic.co/guide/en/beats/winlogbeat/master/exported-fields-ecs.html](https://www.elastic.co/guide/en/beats/winlogbeat/master/exported-fields-ecs.html)

**Attached is a picture of what the SIEM app sees. (and my goal is to get it so I can see what users are logging in and out and also to follow ElasticSearch's best practices)**

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/a/ca3d13619b906277982ce97daa576e087b47bb40.png)

My logstash.conf file

```auto
input {
  beats {
    port => 5044
  }
}

filter {
  geoip {
    source => "[event_data][IpAddress]"
  }
}

output {
  elasticsearch {
    hosts => "logstash.elastic.local:9200"
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
}

```

winlogbeat.yml file

```auto
winlogbeat.event_logs:
  - name: Security
    ignore_older: 168h

output.logstash:
  hosts: ["logstash.elastic.local:9200"]

```

---

<div class="post-metadata">

**Author:** ![iukea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iukea/32/49083_2.png) [@iukea](https://discuss.elastic.co/u/iukea)\
**Post date:** [October 12, 2019, 6:17pm UTC](https://discuss.elastic.co/t/active-directory-logs-and-mapping-to-ecs-i-am-stumped/203321/2 "2019-10-12T18:17:18Z")

</div>

Ah got some progress

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/5/f5f7ae1ddf4ce8c3b44699a5fc84e8a91baeb2d4.png)

This helped  
[https://www.elastic.co/guide/en/beats/winlogbeat/7.4/winlogbeat-module-security.html](https://www.elastic.co/guide/en/beats/winlogbeat/7.4/winlogbeat-module-security.html)

---

<div class="post-metadata">

**Author:** ![iukea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iukea/32/49083_2.png) [@iukea](https://discuss.elastic.co/u/iukea)\
**Post date:** [October 14, 2019, 1:25am UTC](https://discuss.elastic.co/t/active-directory-logs-and-mapping-to-ecs-i-am-stumped/203321/3 "2019-10-14T01:25:47Z")

</div>

still not fully working...

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [October 14, 2019, 12:29pm UTC](https://discuss.elastic.co/t/active-directory-logs-and-mapping-to-ecs-i-am-stumped/203321/4 "2019-10-14T12:29:11Z")

</div>

> [@iukea](#):
>
> still not fully working...

What's not working? I see you enabled the Security module in Winlogbeat.

There's one enhancement in progress to add some additional event IDs into the Security module. These are mostly related to account management events. [https://github.com/elastic/beats/pull/13530](https://github.com/elastic/beats/pull/13530)

---

<div class="post-metadata">

**Author:** ![iukea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iukea/32/49083_2.png) [@iukea](https://discuss.elastic.co/u/iukea)\
**Post date:** [October 14, 2019, 1:55pm UTC](https://discuss.elastic.co/t/active-directory-logs-and-mapping-to-ecs-i-am-stumped/203321/5 "2019-10-14T13:55:57Z")

</div>

Thank you for replying

I am having an issue getting all the Winbeat fields mapped to ECS for the ElasticSearch SIEM app.

(mainly the IP fields, and DNS events) Logging an Active Directory server

I tried setting up a field template called "ecs.yml" which I got from

> <https://github.com/elastic/ecs/blob/master/generated/beats/fields.ecs.yml>

I am also having issues getting GeoIP data to work and tried setting up a pipeline with little luck.

Below is my Winbeat.yml file

```auto
winlogbeat.event_logs:
  - name: Application
    processors:
    - add_host_metadata:
        netinfo.enabled: true
        cache.ttl: 5m
  - name: Security
    processors:
      - script:
          lang: javascript
          id: security
          file: ${path.home}/module/security/config/winlogbeat-security.js
  - name: System

  - name: Microsoft-Windows-Sysmon/Operational
    processors:
      - script:
          lang: javascript
          id: sysmon
          file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js

winlogbeat.event_logs:
  - name: Application
    processors:
    - add_host_metadata:
        netinfo.enabled: true
        cache.ttl: 5m
  
  - name: Security
    processors:
      - script:
            lang: javascript
            id: security
            file: ${path.home}/module/security/config/winlogbeat-security.js
  - name: System

  - name: Microsoft-Windows-Sysmon/Operational
    processors:
      - script:
          lang: javascript
          id: sysmon
          file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js

processors:
- dns:
   type: reverse
   action: append
   fields:
     server.ip: server.hostname
     client.ip: client.hostname
   success_cache:
     capacity.initial: 1000
     capacity.max: 10000
   failure_cache:
    capacity.initial: 1000
    capacity.max: 10000
    ttl: 1m
   nameservers: ['8.8.8.8']
   timeout: 500ms

setup.template.fields: ${path.home}/ecs.yml
output.logstash: 
  hosts: ["192.168.86.3:6050"]
  pipeline: geo-info

```

---

<div class="post-metadata">

**Author:** ![webmat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/webmat/32/46191_2.png) [@webmat](https://discuss.elastic.co/u/webmat)\
**Post date:** [October 14, 2019, 3:15pm UTC](https://discuss.elastic.co/t/active-directory-logs-and-mapping-to-ecs-i-am-stumped/203321/6 "2019-10-14T15:15:41Z")

</div>

You don't need to specifically include the ECS field definitions for any Beat, starting with 7.0, unless you want to make an older Beat (e.g. 7.0 which was ECS 1.0.0) forward-compatible with a later version of ECS (e.g. ECS 1.2.0). But in general, each Beat already defines all ECS fields.

Second note on leveraging the ECS generated files. If you have other more custom pipelines (not this Winlogbeat situation), you should not use files from the master branch of the ECS repo. You should make sure to pick the correct Git tag that matches the ECS release you're targeting.

The destination of your reverse DNS lookup should go to `client.domain` and `server.domain`, there's no `.hostname` field in client/server nor source/destination.

The IP addresses are indeed inside `event_data`, however your Logstash config should look for them at `"[winlog][event_data][IpAddress]"` (you're missing the `winlog` nesting). Adjusting this should get you most of the IP addresses.

Note also that depending on the providers / event IDs you consume, I've seen typos in some `IpAddress` fields. Sometimes it's `Ip Address`, or other small typos. So adjusting to `"[winlog][event_data][IpAddress]"` will get you most of the way there. If you still see it missing from time to time, look for a typo, and add that as a fallback to your pipeline, to correctly capture those as well.

---

<div class="post-metadata">

**Author:** ![iukea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iukea/32/49083_2.png) [@iukea](https://discuss.elastic.co/u/iukea)\
**Post date:** [October 14, 2019, 5:18pm UTC](https://discuss.elastic.co/t/active-directory-logs-and-mapping-to-ecs-i-am-stumped/203321/7 "2019-10-14T17:18:12Z")

</div>

Thank you!

Quick question about Login and Logout processes (event 4672)  
**(External reference link** [https://serverfault.com/questions/800403/a-ton-of-logon-off-events-in-event-viewer](https://serverfault.com/questions/800403/a-ton-of-logon-off-events-in-event-viewer))

generates a tone of login noisily activity

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/7/777bfdb6c698455d75e5583203588236de1b7374.png)

is there any way to filter events " **For 4624 and 4634 events with logon type 3:**" ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 11, 2019, 5:18pm UTC](https://discuss.elastic.co/t/active-directory-logs-and-mapping-to-ecs-i-am-stumped/203321/8 "2019-11-11T17:18:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.