Hello, it seems the event_id filtering is not working for me. Instead, Winlogbeat just sends all events available in the evtx files to the elastic stack.
The buildhash of winlogbeat is "6f0ec01a0e57fe7d4fd703b017fb5a2f6448d097".
I am not running Winlogbeat as a service, because it want to test it first
winlogbeat.registry_file: C:/Winlogbeat/.winlogbeat.yml
winlogbeat.event_logs:
- name: "C:/PROJECTS/BASERD01/System.evtx"
event_id: 1074, 7045 # 1074 #, "7034", "7045" ]
# 1074 => shutdowns/restarts
# 7034 => a service crashed
# 7045 => a new service was created
- name: "C:/PROJECTS/BASERD01/Security.evtx"
event_id: 4697
# service created
setup.template.settings:
index.number_of_shards: 1
setup.kibana:
host: "http://192.168.255.60:5601"
output.elasticsearch:
hosts: ["192.168.255.60:8081"]
protocol: "http"
When I check the configuration file, everything seems to be ok:
.\winlogbeat.exe test config
Config OK
Running Winlogbeat with the above shown config reveals this:
.\winlogbeat.exe -c .\winlogbeat.yml -e
2019-08-15T09:25:11.511+0200 INFO instance/beat.go:606 Home path: [C:\\\r\\nWinlogbeat] Config path: [C:\\\r\\nWinlogbeat] Data path: [C:\\\r\\nWinlogbeat\data] Logs path: [C:\\\r\\nWinlogbeat\logs]
2019-08-15T09:25:11.512+0200 INFO instance/beat.go:614 Beat ID: 61af2bb3-c52b-4b2e-8cbc-5906a8d85ed2
2019-08-15T09:25:11.512+0200 INFO [beat] instance/beat.go:902 Beat info {"system_info": {"beat": {"path": {"config": "C:\\\\r\\n\Winlogbeat", "data": "C:\\\\r\\n\Winlogbeat\\data", "home": "C:\\\\r\\n\Winlogbeat", "logs": "C:\\\\r\\n\Winlogbeat\\logs"}, "type": "winlogbeat", "uuid": "61af2bb3-c52b-4b2e-8cbc-5906a8d85ed2"}}}
2019-08-15T09:25:11.513+0200 INFO [beat] instance/beat.go:911 Build info {"system_info": {"build": {"commit": "6f0ec01a0e57fe7d4fd703b017fb5a2f6448d097", "libbeat": "7.3.0", "time": "2019-07-24T17:45:51.000Z", "version": "7.3.0"}}}
2019-08-15T09:25:11.513+0200 INFO [beat] instance/beat.go:914 Go runtime info {"system_info": {"go": {"os":"windows","arch":"amd64","max_procs":8,"version":"go1.12.4"}}}
2019-08-15T09:25:11.562+0200 INFO [beat] instance/beat.go:918 Host info {"system_info": {"host": {"architecture":"x86_64","boot_time":"2019-08-15T03:14:46.32+02:00","name":"DESKTOP-2QRFRSP","ip":["fe80::6c99:623c:3d21:c1af/64","169.254.193.175/16","fe80::d0bb:67c5:c025:b297/64","169.254.178.151/16","fe80::5dcc:54e9:eb80:d32b/64","169.254.211.43/16","fe80::19c7:aa39:c9cd:2ec6/64","169.254.46.198/16","192.168.200.1/24","192.168.255.1/24","fe80::b8f8:4fad:20d7:a97b/64","10.154.76.46/16","fe80::d802:4de6:e241:eeb0/64","169.254.238.176/16","::1/128","127.0.0.1/8"],"kernel_version":"10.0.18362.295 (WinBuild.160101.0800)","mac":["54:e1:ad:c2:b7:db","44:03:2c:a0:b1:54","46:03:2c:a0:b1:53","00:50:56:c0:00:00","00:50:56:c0:00:01","00:50:56:c0:00:02","44:03:2c:a0:b1:53","44:03:2c:a0:b1:57"],"os":{"family":"windows","platform":"windows","name":"Windows 10 Pro","version":"10.0","major":10,"minor":0,"patch":0,"build":"18362.295"},"timezone":"CEST","timezone_offset_sec":7200,"id":"f11a726e-1434-4be3-9c63-aca07da00b2d"}}}
2019-08-15T09:25:11.566+0200 INFO [beat] instance/beat.go:947 Process info {"system_info": {"process": {"cwd": "C:\\\\r\\n\Winlogbeat", "exe": "C:\\\\r\\n\Winlogbeat\\winlogbeat.exe", "name": "winlogbeat.exe", "pid": 8140, "ppid": 7160, "start_time": "2019-08-15T09:25:11.463+0200"}}}
2019-08-15T09:25:11.566+0200 INFO instance/beat.go:292 Setup Beat: winlogbeat; Version: 7.3.0
2019-08-15T09:25:11.566+0200 INFO [index-management] idxmgmt/std.go:178 Set output.elasticsearch.index to 'winlogbeat-7.3.0' as ILM is enabled.
2019-08-15T09:25:11.567+0200 INFO elasticsearch/client.go:170 Elasticsearch url: http://192.168.255.60:8081
2019-08-15T09:25:11.567+0200 INFO [publisher] pipeline/module.go:97 Beat name: DESKTOP-2QRFRSP
2019-08-15T09:25:11.567+0200 INFO beater/winlogbeat.go:69 State will be read from and persisted to C:/FORENSICS/Winlogbeat/.winlogbeat.yml
2019-08-15T09:25:11.568+0200 INFO instance/beat.go:421 winlogbeat start running.
2019-08-15T09:25:11.568+0200 INFO [monitoring] log/log.go:118 Starting metrics logging every 30s
2019-08-15T09:25:12.856+0200 INFO pipeline/output.go:95 Connecting to backoff(elasticsearch(http://192.168.255.60:8081))
2019-08-15T09:25:12.860+0200 INFO elasticsearch/client.go:743 Attempting to connect to Elasticsearch version 7.3.0
2019-08-15T09:25:12.913+0200 INFO [index-management] idxmgmt/std.go:252 Auto ILM enable success.
2019-08-15T09:25:12.918+0200 INFO [index-management.ilm] ilm/std.go:134 do not generate ilm policy: exists=true, overwrite=false
2019-08-15T09:25:12.918+0200 INFO [index-management] idxmgmt/std.go:265 ILM policy successfully loaded.
2019-08-15T09:25:12.918+0200 INFO [index-management] idxmgmt/std.go:394 Set setup.template.name to '{winlogbeat-7.3.0 {now/d}-000001}' as ILM is enabled.
2019-08-15T09:25:12.918+0200 INFO [index-management] idxmgmt/std.go:399 Set setup.template.pattern to 'winlogbeat-7.3.0-*' as ILM is enabled.
2019-08-15T09:25:12.918+0200 INFO [index-management] idxmgmt/std.go:433 Set settings.index.lifecycle.rollover_alias in template to {winlogbeat-7.3.0 {now/d}-000001} as ILM is enabled.
2019-08-15T09:25:12.918+0200 INFO [index-management] idxmgmt/std.go:437 Set settings.index.lifecycle.name in template to {winlogbeat-7.3.0 {"policy":{"phases":{"hot":{"actions":{"rollover":{"max_age":"30d","max_size":"50gb"}}}}}}} as ILM is enabled.
2019-08-15T09:25:12.924+0200 INFO template/load.go:88 Template winlogbeat-7.3.0 already exists and will not be overwritten.
2019-08-15T09:25:12.924+0200 INFO [index-management] idxmgmt/std.go:289 Loaded index template.
2019-08-15T09:25:12.927+0200 INFO [index-management] idxmgmt/std.go:300 Write alias successfully generated.
2019-08-15T09:25:12.931+0200 INFO pipeline/output.go:105 Connection to backoff(elasticsearch(http://192.168.255.60:8081)) established
2019-08-15T09:25:14.379+0200 INFO beater/eventlogger.go:76 EventLog[C:\PROJECTS\BASERD01\Security.evtx] successfully published 100 events
[...]
(in this case i stopped, because i got more events than i wanted, and event ids i dont want)
Interesstingly, when i look up the data in Kibana i have event.code filed (not event.id)