{"id":2625,"date":"2023-04-10T09:06:06","date_gmt":"2023-04-10T01:06:06","guid":{"rendered":"https:\/\/199604.com\/?p=2625"},"modified":"2023-04-12T09:07:30","modified_gmt":"2023-04-12T01:07:30","slug":"winlogbeat%e7%9a%84%e5%ae%89%e8%a3%85%e4%b8%8e%e4%bd%bf%e7%94%a8","status":"publish","type":"post","link":"https:\/\/199604.com\/2625","title":{"rendered":"Winlogbeat\u7684\u5b89\u88c5\u4e0e\u4f7f\u7528"},"content":{"rendered":"

Winlogbeat\u7684\u5b89\u88c5\u4e0e\u4f7f\u7528<\/h1>\n

\u524d\u8a00<\/h2>\n

\u6700\u65b0\u9700\u6c42\u662f\u9700\u8981\u6536\u96c6windows\u4e00\u4e9b\u5b89\u5168\u65e5\u5fd7\u548c\u4e00\u4e9b\u4e2d\u95f4\u4ef6\u7684\u65e5\u5fd7\uff0c\u4f46\u95ee\u4e86\u516c\u53f8\u73b0\u6709\u4ea7\u54c1\u7684\u516c\u53f8\u662f\u6682\u65f6\u4e0d\u652f\u6301windows\u65e5\u5fd7\u6536\u96c6\uff0c\u4e8e\u662f\u4e4e\u5b89\u5168\u65e5\u5fd7\u6253\u7b97\u4f7f\u7528Winlogbeat<\/code>\u63a8\u9001\u5230kafka\u7136\u540e\u518d\u8fdb\u884c\u5165\u5e93\u6d88\u8d39\u8bb0\u5f55\u3002<\/p>\n

\u4ecb\u7ecd<\/h2>\n

Winlogbeat<\/code> \u662f Windows \u4e8b\u4ef6\u65e5\u5fd7\u7684\u8f7b\u91cf\u7ea7\u6570\u636e\u53d1\u9001\u5668\u3002 \u867d\u7136 Elastic \u7fa4\u96c6\u901a\u5e38\u7528\u4e8e\u5b9e\u65f6\u76d1\u89c6\uff0c\u4f46\u662f\u53ef\u4ee5\u5bf9 Winlogbeat \u8fdb\u884c\u8c03\u6574\uff0c\u4ee5\u624b\u52a8\u5c06\u201c\u51b7\u65e5\u5fd7\u201d\u6216\u65e7\u7684\u975e\u6d3b\u52a8 Windows \u4e8b\u4ef6\u65e5\u5fd7\uff08EVTX\uff09\u624b\u52a8\u53d1\u9001\u7ed9 Elastic Stack\u3002 \u8be5\u529f\u80fd\u4f7f\u5206\u6790\u4eba\u5458\u53ef\u4ee5\u4ece\u6536\u96c6\u7684\u7cfb\u7edf\u56fe\u50cf\u4e2d\u63d0\u53d6 EVTX\u6587 \u4ef6\uff0c\u5e76\u5229\u7528 Elastic \u5806\u6808\u7684\u529f\u80fd\u8fdb\u884c\u8c03\u67e5\u3002<\/p>\n

\u5b89\u88c5<\/h2>\n

Download Link: https:\/\/www.elastic.co\/downloads\/beats\/winlogbeat<\/p>\n

\u6211\u4eec\u53ef\u4ee5\u6839\u636e\u81ea\u5df1\u7684\u7248\u672c\uff08\u548cElasticsearch\u4e00\u6837\u7684\u7248\u672c\uff09\u6765\u8fdb\u884c\u4e0b\u8f7d\u3002\uff08\u8fd9\u91cc\u6211\u7684\u662f7.17.9\uff09<\/p>\n

\"image-20230410085119838\"<\/div><\/p>\n

\"image-20230410085043797\"<\/div><\/p>\n

\u4fee\u6539\u914d\u7f6e\u6587\u4ef6 winlogbeat.yml<\/h3>\n
###################### Winlogbeat Configuration Example ########################\n\n# This file is an example configuration file highlighting only the most common\n# options. The winlogbeat.reference.yml file from the same directory contains\n# all the supported options with more comments. You can use it as a reference.\n#\n# You can find the full configuration reference here:\n# https:\/\/www.elastic.co\/guide\/en\/beats\/winlogbeat\/index.html\n\n# ======================== Winlogbeat specific options =========================\n\n# event_logs specifies a list of event logs to monitor as well as any\n# accompanying options. The YAML data type of event_logs is a list of\n# dictionaries.\n#\n# The supported keys are name, id, xml_query, tags, fields, fields_under_root,\n# forwarded, ignore_older, level, event_id, provider, and include_xml.\n# The xml_query key requires an id and must not be used with the name,\n# ignore_older, level, event_id, or provider keys. Please visit the\n# documentation for the complete details of each option.\n# https:\/\/go.es.io\/WinlogbeatConfig\n\nwinlogbeat.event_logs:\n  - name: Application\n    ignore_older: 72h\n\n  - name: System\n    ignore_older: 72h\n\n  - name: Security\n    ignore_older: 72h\n    event_id: 4624-4627, 4700-4800, -4735\n\n  - name: Microsoft-Windows-Sysmon\/Operational\n    ignore_older: 168h\n    processors:\n      - script:\n          lang: javascript\n          id: sysmon\n          file: ${path.home}\/module\/sysmon\/config\/winlogbeat-sysmon.js\n\n  - name: Windows PowerShell\n    ignore_older: 168h\n    event_id: 400, 403, 600, 800\n    processors:\n      - script:\n          lang: javascript\n          id: powershell\n          file: ${path.home}\/module\/powershell\/config\/winlogbeat-powershell.js\n\n  - name: Microsoft-Windows-PowerShell\/Operational\n    ignore_older: 168h\n    event_id: 4103, 4104, 4105, 4106\n    processors:\n      - script:\n          lang: javascript\n          id: powershell\n          file: ${path.home}\/module\/powershell\/config\/winlogbeat-powershell.js\n\n  - name: ForwardedEvents\n    ignore_older: 168h\n    tags: [forwarded]\n    processors:\n      - script:\n          when.equals.winlog.channel: Security\n          lang: javascript\n          id: security\n          file: ${path.home}\/module\/security\/config\/winlogbeat-security.js\n      - script:\n          when.equals.winlog.channel: Microsoft-Windows-Sysmon\/Operational\n          lang: javascript\n          id: sysmon\n          file: ${path.home}\/module\/sysmon\/config\/winlogbeat-sysmon.js\n      - script:\n          when.equals.winlog.channel: Windows PowerShell\n          lang: javascript\n          id: powershell\n          file: ${path.home}\/module\/powershell\/config\/winlogbeat-powershell.js\n      - script:\n          when.equals.winlog.channel: Microsoft-Windows-PowerShell\/Operational\n          lang: javascript\n          id: powershell\n          file: ${path.home}\/module\/powershell\/config\/winlogbeat-powershell.js\n\n# ====================== Elasticsearch template settings =======================\n\nsetup.template.settings:\n  index.number_of_shards: 1\n  #index.codec: best_compression\n  #_source.enabled: false\n\n\n# ================================== General ===================================\n\n# The name of the shipper that publishes the network data. It can be used to group\n# all the transactions sent by a single shipper in the web interface.\n#name:\nname: 'ip_addr'\n# The tags of the shipper are included in their own field with each\n# transaction published.\n#tags: [\"service-X\", \"web-tier\"]\n\n# Optional fields that you can specify to add additional information to the\n# output.\n#fields:\n#  env: staging\n\n# ================================= Dashboards =================================\n# These settings control loading the sample dashboards to the Kibana index. Loading\n# the dashboards is disabled by default and can be enabled either by setting the\n# options here or by using the `setup` command.\n#setup.dashboards.enabled: false\n\n# The URL from where to download the dashboards archive. By default this URL\n# has a value which is computed based on the Beat name and version. For released\n# versions, this URL points to the dashboard archive on the artifacts.elastic.co\n# website.\n#setup.dashboards.url:\n\n# =================================== Kibana ===================================\n\n# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.\n# This requires a Kibana endpoint configuration.\nsetup.kibana:\n\n  # Kibana Host\n  # Scheme and port can be left out and will be set to the default (http and 5601)\n  # In case you specify and additional path, the scheme is required: http:\/\/localhost:5601\/path\n  # IPv6 addresses should always be defined as: https:\/\/[2001:db8::1]:5601\n  #host: \"localhost:5601\"\n\n  # Kibana Space ID\n  # ID of the Kibana Space into which the dashboards should be loaded. By default,\n  # the Default Space will be used.\n  #space.id:\n\n# =============================== Elastic Cloud ================================\n\n# These settings simplify using Winlogbeat with the Elastic Cloud (https:\/\/cloud.elastic.co\/).\n\n# The cloud.id setting overwrites the `output.elasticsearch.hosts` and\n# `setup.kibana.host` options.\n# You can find the `cloud.id` in the Elastic Cloud web UI.\n#cloud.id:\n\n# The cloud.auth setting overwrites the `output.elasticsearch.username` and\n# `output.elasticsearch.password` settings. The format is `<user>:<pass>`.\n#cloud.auth:\n\n# ================================== Outputs ===================================\n\n# Configure what output to use when sending the data collected by the beat.\n# ----------------------------kafka--------------------------------------\noutput.kafka:\n  hosts: [\"10.196.69.25:9092\",\"10.196.69.26:9092\"]\n  topic: 'dola_windows_log'\n\n  required_acks: 1\n  compression: gzip\n  max_message_bytes: 1000000\n\n# ---------------------------- Elasticsearch Output ----------------------------\n# output.elasticsearch:\n  # Array of hosts to connect to.\n  # hosts: [\"localhost:9200\"]\n\n  # Protocol - either `http` (default) or `https`.\n  #protocol: \"https\"\n\n  # Authentication credentials - either API key or username\/password.\n  #api_key: \"id:api_key\"\n  #username: \"elastic\"\n  #password: \"changeme\"\n\n# ------------------------------ Logstash Output -------------------------------\n#output.logstash:\n  # The Logstash hosts\n  #hosts: [\"localhost:5044\"]\n\n  # Optional SSL. By default is off.\n  # List of root certificates for HTTPS server verifications\n  #ssl.certificate_authorities: [\"\/etc\/pki\/root\/ca.pem\"]\n\n  # Certificate for SSL client authentication\n  #ssl.certificate: \"\/etc\/pki\/client\/cert.pem\"\n\n  # Client Certificate Key\n  #ssl.key: \"\/etc\/pki\/client\/cert.key\"\n\n# ================================= Processors =================================\nprocessors:\n  - add_host_metadata:\n      when.not.contains.tags: forwarded\n  - add_cloud_metadata: ~\n\n# ================================== Logging ===================================\nlogging.to_files: true\nlogging.files:\n  path: D:\\winlogbeat-7.17.9-windows-x86_64\\Logs\nlogging.level: info\n# Sets log level. The default log level is info.\n# Available log levels are: error, warning, info, debug\n#logging.level: debug\n\n# At debug level, you can selectively enable logging only for some components.\n# To enable all selectors use [\"*\"]. Examples of other selectors are \"beat\",\n# \"publisher\", \"service\".\n#logging.selectors: [\"*\"]\n\n# ============================= X-Pack Monitoring ==============================\n# Winlogbeat can export internal metrics to a central Elasticsearch monitoring\n# cluster.  This requires xpack monitoring to be enabled in Elasticsearch.  The\n# reporting is disabled by default.\n\n# Set to true to enable the monitoring reporter.\n#monitoring.enabled: false\n\n# Sets the UUID of the Elasticsearch cluster under which monitoring data for this\n# Winlogbeat instance will appear in the Stack Monitoring UI. If output.elasticsearch\n# is enabled, the UUID is derived from the Elasticsearch cluster referenced by output.elasticsearch.\n#monitoring.cluster_uuid:\n\n# Uncomment to send the metrics to Elasticsearch. Most settings from the\n# Elasticsearch output are accepted here as well.\n# Note that the settings should point to your Elasticsearch *monitoring* cluster.\n# Any setting that is not set is automatically inherited from the Elasticsearch\n# output configuration, so if you have the Elasticsearch output configured such\n# that it is pointing to your Elasticsearch monitoring cluster, you can simply\n# uncomment the following line.\n#monitoring.elasticsearch:\n\n# ============================== Instrumentation ===============================\n\n# Instrumentation support for the winlogbeat.\n#instrumentation:\n    # Set to true to enable instrumentation of winlogbeat.\n    #enabled: false\n\n    # Environment in which winlogbeat is running on (eg: staging, production, etc.)\n    #environment: \"\"\n\n    # APM Server hosts to report instrumentation results to.\n    #hosts:\n    #  - http:\/\/localhost:8200\n\n    # API Key for the APM Server(s).\n    # If api_key is set then secret_token will be ignored.\n    #api_key:\n\n    # Secret token for the APM Server(s).\n    #secret_token:\n\n\n# ================================= Migration ==================================\n\n# This allows to enable 6.7 migration aliases\n#migration.6_to_7.enabled: true\n\n\n<\/code><\/pre>\n
\u542f\u52a8<\/h2>\n
\u6d4b\u8bd5\u547d\u4ee4<\/h3>\n
.\\winlogbeat.exe test config -c .\\winlogbeat.yml -e<\/code><\/p>\n
\u6b63\u5f0f\u542f\u52a8<\/h3>\n
.\\winlogbeat.exe -e -c winlogbeat.yml<\/code><\/p>\n
\"image-20230410085830436\"<\/div><\/p>\n
\n  \u4f1a\u5f39\u51fa\u5f88\u591a\u4fe1\u606f\uff0c\u6bd5\u7adf\u6211\u4eec -e \u53c2\u6570\u5c31\u662f\u628a\u4fe1\u606f\u6253\u5370\u5230\u5c4f\u5e55\u4e0a\uff1b<\/p>\n
  \u521d\u6b21\u4f7f\u7528\u8c03\u8bd5\u7684\u65f6\u5019\u5f88\u5b9e\u7528\n<\/p><\/blockquote>\n
\u628a winlogbeat \u5c01\u88c5\u6210\u670d\u52a1\u542f\u52a8(\u770b\u9700\u6c42\u5b89\u5168\u662f\u5426\u9700\u8981)<\/h3>\n
\u5982\u4e0b\u56fe\uff0c\u6211\u4eec\u53ef\u4ee5\u770b\u5230\u6587\u4ef6\u5939\u91cc\u6709\u5c01\u88c5\u6210\u670d\u52a1\u5668\u7684PS\u811a\u672c<\/p>\n
\"image-20230410090105540\"<\/div><\/p>\n
\u76f4\u63a5\u6267\u884c\u5c31\u5b89\u88c5<\/h4>\n
\u5b89\u88c5<\/h5>\n
.\\install-service-winlogbeat.ps1<\/code><\/p>\n
\u5378\u8f7d<\/h5>\n
.\\uninstall-service-winlogbeat.ps1<\/code><\/p>\n
\u53ef\u80fd\u4f1a\u63d0\u793a\u6ca1\u6709\u6743\u9650\uff0c\u9700\u8981\u6267\u884c\u5982\u4e0b\u64cd\u4f5c
\nSet-ExecutionPolicy -ExecutionPolicy RemoteSigned<\/code><\/p>\n
\n  \u8fd9\u662fpowershell\u6267\u884c\u7b56\u7565\u7684\u95ee\u9898\uff0c\u8be6\u60c5:https:\/\/learn.microsoft.com\/zh-cn\/previous-versions\/windows\/powershell-scripting\/hh847748(v=wps.640)\n<\/p><\/blockquote>\n
\u542f\u52a8\u670d\u52a1<\/h4>\n
Start-Service winlogbeat<\/code><\/p>\n
\u505c\u6b62\u670d\u52a1<\/h4>\n
Stop-Service winlogbeat<\/code><\/p>\n
\u53c2\u8003<\/h2>\n
    \n
  1. https:\/\/blog.csdn.net\/UbuntuTouch\/article\/details\/103170326<\/li>\n
  2. https:\/\/www.elastic.co\/guide\/en\/beats\/winlogbeat\/7.5\/winlogbeat-installation.html<\/li>\n
  3. https:\/\/cloud.tencent.com\/document\/product\/614\/80150<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"
    Winlogbeat\u7684\u5b89\u88c5\u4e0e\u4f7f\u7528 \u524d\u8a00 \u6700\u65b0\u9700\u6c42\u662f\u9700\u8981\u6536\u96c6windows\u4e00\u4e9b\u5b89\u5168\u65e5\u5fd7\u548c\u4e00\u4e9b\u4e2d\u95f4\u4ef6\u7684\u65e5\u5fd7\uff0c\u4f46\u95ee\u4e86 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[364],"tags":[363,463],"class_list":["post-2625","post","type-post","status-publish","format-standard","hentry","category-elk","tag-elk","tag-winlogbeat"],"_links":{"self":[{"href":"https:\/\/199604.com\/wp-json\/wp\/v2\/posts\/2625","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/199604.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/199604.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/199604.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/199604.com\/wp-json\/wp\/v2\/comments?post=2625"}],"version-history":[{"count":3,"href":"https:\/\/199604.com\/wp-json\/wp\/v2\/posts\/2625\/revisions"}],"predecessor-version":[{"id":2628,"href":"https:\/\/199604.com\/wp-json\/wp\/v2\/posts\/2625\/revisions\/2628"}],"wp:attachment":[{"href":"https:\/\/199604.com\/wp-json\/wp\/v2\/media?parent=2625"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/199604.com\/wp-json\/wp\/v2\/categories?post=2625"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/199604.com\/wp-json\/wp\/v2\/tags?post=2625"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}