Winlogbeat processor for powershell module

This page shows how to enable modules for security and sysmon but nothing for powershell.

winlogbeat.event_logs:

  • name: ForwardedEvents
    tags: [forwarded]
    processors:
    • script:
      when.equals.winlog.channel: Security
      lang: javascript
      id: security
      file: ${path.home}/module/security/config/winlogbeat-security.js
    • script:
      when.equals.winlog.channel: Microsoft-Windows-Sysmon/Operational
      lang: javascript
      id: sysmon
      file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js

If you want to enable powershell you need to do it like shown here

winlogbeat.event_logs:

  • name: Windows PowerShell
    event_id: 400, 403, 600, 800
    processors:

    • script:
      lang: javascript
      id: powershell
      file: ${path.home}/module/powershell/config/winlogbeat-powershell.js
  • name: Microsoft-Windows-PowerShell/Operational
    event_id: 4103, 4104, 4105, 4106
    processors:

    • script:
      lang: javascript
      id: powershell-operational
      file: ${path.home}/module/powershell/config/winlogbeat-powershell.js

Is it possible to enable powershell module according to the first type? For example somehow

processors:
- script:
when.equals.winlog.channel: Windows PowerShell and when.equals.event_id: 400, 403, 600, 800

How to include multiple conditions into processor script?

I found the solution myself.

 - script:
     when.equals.winlog.channel: Security
     lang: javascript
     id: security
     file: ${path.home}/module/security/config/winlogbeat-security.js
  - script:
     when.equals.winlog.channel: Microsoft-Windows-Sysmon/Operational
     lang: javascript
     id: sysmon
     file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js
  - script:
     and:
      equals.winlog.channel: Windows PowerShell
      or:
       equals.event_id: 400
       equals.event_id: 403
       equals.event_id: 600
       equals.event_id: 800
     lang: javascript
     id: powershell
     file: ${path.home}/module/powershell/config/winlogbeat-powershell.js     
  - script:
     and:
      equals.winlog.channel: Microsoft-Windows-PowerShell/Operational
      or:
       equals.event_id: 4103
       equals.event_id: 4104
       equals.event_id: 4105
       equals.event_id: 4106
     lang: javascript
     id: powershell-operational
     file: ${path.home}/module/powershell/config/winlogbeat-powershell.js 

Hello

I have similar topic, with winlogbeat 7.9 I'm trying to get fields which are "nested" in message field:
for example:
"message": "Endpoint: xxxyy211\nEndpoint IP: 10.1.1.x\nDomain: Agents\\xxx\\update\\\nDate/Time: 22.09.2020 13:43:16\nDetailed information:

All other "normal" fields can index without problem. There is some special option to start process such kind of fields as seperate fields?

thanks for help
Pedro

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.