Winlogbeat processor for powershell module

[v.n (Vladimir Bunin)]

This page shows how to enable modules for security and sysmon but nothing for powershell.

winlogbeat.event_logs:

• name: ForwardedEvents
  tags: [forwarded]
  processors:
  • script:
    when.equals.winlog.channel: Security
    lang: javascript
    id: security
    file: ${path.home}/module/security/config/winlogbeat-security.js
  • script:
    when.equals.winlog.channel: Microsoft-Windows-Sysmon/Operational
    lang: javascript
    id: sysmon
    file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js

If you want to enable powershell you need to do it like shown here

winlogbeat.event_logs:

• name: Windows PowerShell
  event_id: 400, 403, 600, 800
  processors:

  • script:
    lang: javascript
    id: powershell
    file: ${path.home}/module/powershell/config/winlogbeat-powershell.js

• name: Microsoft-Windows-PowerShell/Operational
  event_id: 4103, 4104, 4105, 4106
  processors:

  • script:
    lang: javascript
    id: powershell-operational
    file: ${path.home}/module/powershell/config/winlogbeat-powershell.js

Is it possible to enable powershell module according to the first type? For example somehow

processors:
- script:
when.equals.winlog.channel: Windows PowerShell and when.equals.event_id: 400, 403, 600, 800

How to include multiple conditions into processor script?

[v.n (Vladimir Bunin)]

I found the solution myself.

 - script:
     when.equals.winlog.channel: Security
     lang: javascript
     id: security
     file: ${path.home}/module/security/config/winlogbeat-security.js
  - script:
     when.equals.winlog.channel: Microsoft-Windows-Sysmon/Operational
     lang: javascript
     id: sysmon
     file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js
  - script:
     and:
      equals.winlog.channel: Windows PowerShell
      or:
       equals.event_id: 400
       equals.event_id: 403
       equals.event_id: 600
       equals.event_id: 800
     lang: javascript
     id: powershell
     file: ${path.home}/module/powershell/config/winlogbeat-powershell.js     
  - script:
     and:
      equals.winlog.channel: Microsoft-Windows-PowerShell/Operational
      or:
       equals.event_id: 4103
       equals.event_id: 4104
       equals.event_id: 4105
       equals.event_id: 4106
     lang: javascript
     id: powershell-operational
     file: ${path.home}/module/powershell/config/winlogbeat-powershell.js 

[Pedro_77]

Hello

I have similar topic, with winlogbeat 7.9 I'm trying to get fields which are "nested" in message field:
for example:
"message": "Endpoint: xxxyy211\nEndpoint IP: 10.1.1.x\nDomain: Agents\\xxx\\update\\\nDate/Time: 22.09.2020 13:43:16\nDetailed information:

All other "normal" fields can index without problem. There is some special option to start process such kind of fields as seperate fields?

thanks for help
Pedro