Skip to content

Instantly share code, notes, and snippets.

@andrewkroh
Created May 19, 2022 17:47
Show Gist options
  • Save andrewkroh/22bd4f697c1cc5214cd2e1ce1748aca4 to your computer and use it in GitHub Desktop.
Save andrewkroh/22bd4f697c1cc5214cd2e1ce1748aca4 to your computer and use it in GitHub Desktop.
Winlogbeat script to log specific event IDs
winlogbeat.event_logs:
- name: Security
ignore_older: 1h
processors:
- script:
lang: javascript
source: |
var console = require("console");
var ids = {
4728: null,
4729: null,
4732: null,
4733: null,
4756: null,
4757: null,
4758: null,
}
function process(evt) {
var eventID = evt.Get("winlog.event_id");
if (ids[eventID] !== undefined) {
console.info("EVENT_ID_FOUND: Read event ID", eventID);
evt.AppendTo("tags", "EVENT_ID_FOUND");
}
}
- script:
lang: javascript
id: security
file: "C:/Program Files/Winlogbeat/module/security/config/winlogbeat-security.js"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment