Graylog2 / Graylog2/graylog2-server

Powershell template for Winlogbeat

Open
#16,018 0 comments 0 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## What?

A suggestion came from the community to add a sample winlogbeat template for Powershell to go along with the other templates we provide.

## Why?

Agent templates make adding new log sources easier and reduce support requests both in the community and in commercial support channels. The more sample configurations available, the better. Customer submitted this configuration as a possible starting point.

```
# Needed for Graylog
fields_under_root: true
fields.collector_node_id: ${sidecar.nodeName}
fields.gl2_source_collector: ${sidecar.nodeId}

output.logstash:
hosts: ["graylog_server_name:5044"]

path.data: C:\Program Files\Graylog\sidecar\cache\winlogbeat\data
path.logs: C:\Program Files\Graylog\sidecar\logs
path.module: C:\Program Files\Graylog\sidecar\module

winlogbeat.event_logs:

#PowerShell
- name: Windows PowerShell
event_id: 400, 403, 600, 800
ignore_older: 48h
processors:
- script:
lang: javascript
id: powershell
file: C:\Program Files\Graylog\sidecar\module\powershell\config\winlogbeat-powershell.js

- name: Microsoft-Windows-PowerShell/Operational
event_id: 4100, 4103, 4104, 4105, 4106
ignore_older: 48h
processors:
- script:
lang: javascript
id: powershell
file: C:\Program Files\Graylog\sidecar\module\powershell\config\winlogbeat-powershell.js
```

## Your Environment

* Graylog Version:
* OpenSearch Version:
* MongoDB Version:
* Operating System:
* Browser version:

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.