Skip to content

Instantly share code, notes, and snippets.

Created May 19, 2022 17:47
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
Star You must be signed in to star a gist
What would you like to do?
Winlogbeat script to log specific event IDs
- name: Security
ignore_older: 1h
- script:
lang: javascript
source: |
var console = require("console");
var ids = {
4728: null,
4729: null,
4732: null,
4733: null,
4756: null,
4757: null,
4758: null,
function process(evt) {
var eventID = evt.Get("winlog.event_id");
if (ids[eventID] !== undefined) {"EVENT_ID_FOUND: Read event ID", eventID);
evt.AppendTo("tags", "EVENT_ID_FOUND");
- script:
lang: javascript
id: security
file: "C:/Program Files/Winlogbeat/module/security/config/winlogbeat-security.js"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment