https://docs.logz.io/assets/js/14878431.f5cc79c0.js

1"use strict";(self.webpackChunkmy_website=self.webpackChunkmy_website||[]).push([[1083],{3905:(e,t,n)=>{n.d(t,{Zo:()=>d,kt:()=>m});var o=n(67294);function r(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function i(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,o)}return n}function a(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?i(Object(n),!0).forEach((function(t){r(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):i(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function s(e,t){if(null==e)return{};var n,o,r=function(e,t){if(null==e)return{};var n,o,r={},i=Object.keys(e);for(o=0;o<i.length;o++)n=i[o],t.indexOf(n)>=0||(r[n]=e[n]);return r}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(o=0;o<i.length;o++)n=i[o],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(r[n]=e[n])}return r}var l=o.createContext({}),p=function(e){var t=o.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):a(a({},t),e)),n},d=function(e){var t=p(e.components);return o.createElement(l.Provider,{value:t},e.children)},c="mdxType",u={inlineCode:"code",wrapper:function(e){var t=e.children;return o.createElement(o.Fragment,{},t)}},g=o.forwardRef((function(e,t){var n=e.components,r=e.mdxType,i=e.originalType,l=e.parentName,d=s(e,["components","mdxType","originalType","parentName"]),c=p(n),g=r,m=c["".concat(l,".").concat(g)]||c[g]||u[g]||i;return n?o.createElement(m,a(a({ref:t},d),{},{components:n})):o.createElement(m,a({ref:t},d))}));function m(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var i=n.length,a=new Array(i);a[0]=g;var s={};for(var l in t)hasOwnProperty.call(t,l)&&(s[l]=t[l]);s.originalType=e,s[c]="string"==typeof e?e:r,a[1]=s;for(var p=2;p<i;p++)a[p]=n[p];return o.createElement.apply(null,a)}return o.createElement.apply(null,n)}g.displayName="MDXCreateElement"},19124:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>a,default:()=>u,frontMatter:()=>i,metadata:()=>s,toc:()=>p});var o=n(87462),r=(n(67294),n(3905));const i={id:"Windows-Defender",title:"Windows Defender via Winlogbeat",overview:"This integration enable you to send Windows Defender events to Logz.io using winlogbeat",product:["logs","siem"],os:["windows"],filters:["Security"],logo:"https://logzbucket.s3.eu-west-1.amazonaws.com/logz-docs/shipper-logos/windows-defender.svg",logs_dashboards:[],logs_alerts:[],logs2metrics:[],metrics_dashboards:[],metrics_alerts:[],drop_filter:[]},a=void 0,s={unversionedId:"shipping/Security/Windows-Defender",id:"shipping/Security/Windows-Defender",title:"Windows Defender via Winlogbeat",description:"Windows Defender is an anti-malware component of Microsoft Windows. This integration allows you to send Windows Defender logs to your Logz.io SIEM account.",source:"@site/docs/shipping/Security/windows-defender.md",sourceDirName:"shipping/Security",slug:"/shipping/Security/Windows-Defender",permalink:"/docs/shipping/Security/Windows-Defender",draft:!1,editUrl:"https://github.com/logzio/documentation/tree/master/docs/shipping/Security/windows-defender.md",tags:[],version:"current",frontMatter:{id:"Windows-Defender",title:"Windows Defender via Winlogbeat",overview:"This integration enable you to send Windows Defender events to Logz.io using winlogbeat",product:["logs","siem"],os:["windows"],filters:["Security"],logo:"https://logzbucket.s3.eu-west-1.amazonaws.com/logz-docs/shipper-logos/windows-defender.svg",logs_dashboards:[],logs_alerts:[],logs2metrics:[],metrics_dashboards:[],metrics_alerts:[],drop_filter:[]},sidebar:"tutorialSidebar",previous:{title:"Wazuh",permalink:"/docs/shipping/Security/Wazuh"},next:{title:"x509",permalink:"/docs/shipping/Security/x509"}},l={},p=[{value:"Configure Windows Defender audit permissions",id:"configure-windows-defender-audit-permissions",level:3},{value:"Download the Logz.io public certificate",id:"download-the-logzio-public-certificate",level:3}

1,{value:"Configure Windows input",id:"configure-windows-input",level:3},{value:"Add Logz.io as an output",id:"add-logzio-as-an-output",level:3},{value:"Restart Winlogbeat",id:"restart-winlogbeat",level:3},{value:"Check Logz.io for your logs",id:"check-logzio-for-your-logs",level:3}],d={toc:p},c="wrapper";function u(e){let{components:t,...n}=e;return(0,r.kt)(c,(0,o.Z)({},d,n,{components:t,mdxType:"MDXLayout"}),(0,r.kt)("p",null,"Windows Defender is an anti-malware component of Microsoft Windows. This integration allows you to send Windows Defender logs to your Logz.io SIEM account."),(0,r.kt)("p",null,(0,r.kt)("strong",{parentName:"p"},"Before you begin, you'll need"),":\n",(0,r.kt)("a",{parentName:"p",href:"https://www.elastic.co/guide/en/beats/winlogbeat/8.7/winlogbeat-installation-configuration.html#installation"},"Winlogbeat 8"),", ",(0,r.kt)("a",{parentName:"p",href:"https://www.elastic.co/downloads/beats/winlogbeat"},"Winlogbeat 7")," or\n",(0,r.kt)("a",{parentName:"p",href:"https://www.elastic.co/guide/en/beats/winlogbeat/6.8/winlogbeat-installation.html"},"Winlogbeat 6"),"."),(0,r.kt)("h3",{id:"configure-windows-defender-audit-permissions"},"Configure Windows Defender audit permissions"),(0,r.kt)("p",null,'In the Windows taskbar search box, type "gpedit"\nand click ',(0,r.kt)("strong",{parentName:"p"},"Edit group policy"),".\nYou'll see the ",(0,r.kt)("em",{parentName:"p"},"Local Group Policy Editor"),"."),(0,r.kt)("p",null,(0,r.kt)("img",{parentName:"p",src:"https://dytvr9ot2sszz.cloudfront.net/logz-docs/windows/local-group-policy-editor.png",alt:"Local Group Policy Editor"})),(0,r.kt)("p",null,"In the left pane, select ",(0,r.kt)("strong",{parentName:"p"},"Windows Settings > Security Settings > Local Policies > Audit Policy"),".\nIn the right pane, open ",(0,r.kt)("strong",{parentName:"p"},"Audit object access"),"."),(0,r.kt)("p",null,(0,r.kt)("img",{parentName:"p",src:"https://dytvr9ot2sszz.cloudfront.net/logz-docs/windows/audit-object-access-properties.png",alt:"Audit object access Properties"})),(0,r.kt)("p",null,"Select ",(0,r.kt)("strong",{parentName:"p"},"Success")," and ",(0,r.kt)("strong",{parentName:"p"},"Failure"),", and click ",(0,r.kt)("strong",{parentName:"p"},"OK"),"."),(0,r.kt)("p",null,'Back in the Windows taskbar search box, type "regedit"\nand click ',(0,r.kt)("strong",{parentName:"p"},"Registry Editor"),"."),(0,r.kt)("p",null,(0,r.kt)("img",{parentName:"p",src:"https://dytvr9ot2sszz.cloudfront.net/logz-docs/windows/registry-editor-windows-defender-context-menu.png",alt:"Windows Registry Editor"})),(0,r.kt)("p",null,'In the search bar at the top of the window, paste\n"Computer\\HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender".'),(0,r.kt)("p",null,"In the left pane, right-click the ",(0,r.kt)("em",{parentName:"p"},"Windows Defender")," folder,\nthen click ",(0,r.kt)("strong",{parentName:"p"},"Permissions...")," to show ",(0,r.kt)("em",{parentName:"p"},"Permissions for Windows Defender"),".\nClick ",(0,r.kt)("strong",{parentName:"p"},"Advanced")," to show ",(0,r.kt)("em",{parentName:"p"},"Advanced Security Settings for Windows Defender"),"."),(0,r.kt)("p",null,(0,r.kt)("img",{parentName:"p",src:"https://dytvr9ot2sszz.cloudfront.net/logz-docs/windows/advanced-security-settings-for-windows-defender.png",alt:"Advanced Security Settings for Windows Defender"})),(0,r.kt)("p",null,"In the ",(0,r.kt)("em",{parentName:"p"},"Auditing")," tab, click ",(0,r.kt)("strong",{parentName:"p"},"Add")," to show the ",(0,r.kt)("em",{parentName:"p"},"Auditing Entry for Windows Defender")," dialog."),(0,r.kt)("p",null,"Click ",(0,r.kt)("strong",{parentName:"p"},"Select a principal")," to show the ",(0,r.kt)("em",{parentName:"p"},"Select User or Group")," dialog."),(0,r.kt)("p",null,(0,r.kt)("img",{parentName:"p",src:"https://dytvr9ot2sszz.cloudfront.net/logz-docs/windows/select-user-or-group.png",alt:"Select User or Group"})),(0,r.kt)("p",null,'Type "Administrators" in the text box and click ',(0,r.kt)("strong",{parentName:"p"},"Check Names"),"."),(0,r.kt)("p",null,"Now click ",(0,r.kt)("strong",{parentName:"p"},"OK")," to exit all those dialogs you just opened. \ud83d\ude2c"),(0,r.kt)("h3",{id:"download-the-logzio-public-certificate"},"Download the Logz.io public certificate"),(0,r.kt)("p",null,"Download the\n",(0,r.kt)("a",{parentName:"p",href:"https://raw.githubusercontent.com/logzio/public-certificates/master/AAACertificateServices.crt"},"Logz.io public certificate"),"\nto ",(0,r.kt)("inlineCode",{parentName:"p"},"C:\\ProgramData\\Winlogbeat\\AAACertificateServices.crt"),"\non your machine."),(0,r.kt)("h3",{id:"configure-windows-input"},"Configure Windows input"),(0,r.kt)("p",null,"If you're working with the default configuration file,\n(",(0,r.kt)("inlineCode",{parentName:"p"},"C:\\Program Files\\Winlogbeat\\winlogbeat.yml"),")\nclear the content and start with a fresh file."),(0,r.kt)("p",null,"Paste this code block."),(0,r.kt)("p",null,"Replace ",(0,r.kt)("inlineCode",{parentName:"p"},"<<LOG-SHIPPING-TOKEN>>")," with the token of the account you want to ship to."),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre",className:"language-yaml"},"winlogbeat.event_logs:\n  - name: Application\n    ignore_older: 72h\n  - name: System\

1n  - name: Microsoft-Windows-Sysmon/Operational\n  - name: Microsoft-Windows-Windows Defender/Operational\n  - name: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall\n\nfields:\n  logzio_codec: json\n  token: <<LOG-SHIPPING-TOKEN>>\n  type: wineventlog\nfields_under_root: true\n")),(0,r.kt)("p",null,"If you're running Winlogbeat 7 or 8, paste this code block.\nOtherwise, you can leave it out."),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre",className:"language-yaml"},'# ... For Winlogbeat 7 or 8 only ...\nprocessors:\n  - rename:\n      fields:\n      - from: "agent"\n        to: "beat_agent"\n      ignore_missing: true\n  - rename:\n      fields:\n      - from: "log.file.path"\n        to: "source"\n      ignore_missing: true\n  - rename:\n      fields:\n      - from: "log"\n        to: "log_information"\n      ignore_missing: true\n')),(0,r.kt)("h3",{id:"add-logzio-as-an-output"},"Add Logz.io as an output"),(0,r.kt)("p",null,"If Logz.io isn't the output, set it now. "),(0,r.kt)("p",null,"Winlogbeat can have one output only, so remove any other ",(0,r.kt)("inlineCode",{parentName:"p"},"output")," entries."),(0,r.kt)("p",null,"Replace ",(0,r.kt)("inlineCode",{parentName:"p"},"<<LISTENER-HOST>>")," with the host ",(0,r.kt)("a",{parentName:"p",href:"https://docs.logz.io/docs/user-guide/admin/hosting-regions/account-region/#available-regions"},"for your region"),". "),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre",className:"language-yaml"},"output.logstash:\n  hosts: [\"<<LISTENER-HOST>>:5015\"]\n  ssl:\n    certificate_authorities: ['C:\\ProgramData\\Winlogbeat\\AAACertificateServices.crt']\n")),(0,r.kt)("h3",{id:"restart-winlogbeat"},"Restart Winlogbeat"),(0,r.kt)("p",null,"Open PowerShell as an admin and run this command:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre",className:"language-powershell"},"Restart-Service winlogbeat\n")),(0,r.kt)("h3",{id:"check-logzio-for-your-logs"},"Check Logz.io for your logs"),(0,r.kt)("p",null,"Give your logs some time to get from your system to ours, and then open ",(0,r.kt)("a",{parentName:"p",href:"https://app.logz.io/#/dashboard/osd"},"Open Search Dashboards"),"."),(0,r.kt)("p",null,"If you still don't see your logs, see ",(0,r.kt)("a",{parentName:"p",href:"https://docs.logz.io/docs/user-guide/log-management/troubleshooting/troubleshooting-filebeat/"},"Filebeat troubleshooting"),"."))}u.isMDXComponent=!0}}]);