使用Winlogbeat 5.x處理器篩選用戶登錄事件

Question

我是Elastic堆棧的新手，現在我正在使用Winlogbeat來監視用戶登錄。在將事件發送到Elasticsearch之前，我想刪除用戶未生成的登錄事件（例如系統和服務帳戶）。

我試過使用processors，但它似乎沒有工作。文檔非常小，沒有工作示例。

這是我的處理器配置：

processors: 
- drop_event: 
    when: 
     regexp: 
      event_data.TargetUserName: ".*$" 

processors: 
- drop_event: 
    when: 
     equals: 
      event_data.LogonType: "0" 

processors: 
- drop_event: 
    when: 
     equals: 
      event_data.LogonType: "5" 

但是我得到這個作爲結果：

"LogonType": "3", 
"ProcessId": "0x0", 
"ProcessName": "-", 
"SubjectDomainName": "-", 
"SubjectLogonId": "0x0", 
"SubjectUserName": "-", 
"SubjectUserSid": "S-1-0-0", 
"TargetDomainName": "DOMAIN", 
"TargetLogonId": "0x14d570eec", 
"TargetUserName": "MACHINE-01$", 
"TargetUserSid": "S-1-5-18", 
"TransmittedServices": "-" 

誰能告訴我有什麼不對我的處理器配置？

Answer 1

您已在YAML配置文件中聲明瞭三個單獨的processors變量。應該只有一個。 processors是一個列表，因此您可以將多個項目添加到列表中。處理器及其條件有documentation。

processors: 
- <processor_name>: 
    when: 
     <condition> 
      <parameters> 
- <processor_name>: 
    when: 
     <condition> 
      <parameters> 

既然你要在任何的條件，則可以使用一個drop_event處理器與or狀態下降的情況下。這是一個例子。

processors: 
- drop_event: 
    when.or: 
     # This filters logons from managed service accounts. 
     # The trailing dollar sign is reserved for managed service accounts. 
     - regexp.event_data.TargetUserName: '.*\$' 

     # This filters logon type 0 which is used for system accounts. 
     - equals.event_data.LogonType: '0' 

     # This filters logon type 5 which is used for service accounts. 
     - equals.event_data.LogonType: '5' 

     # This filters anonymous logons which are typically benign. 
     # Anonymous users have extremely limited privileges. 
     - equals.event_data.TargetUserName: 'ANONYMOUS LOGON' 

我想你可能是以下一些在本Winlogbeat博客文章中列出的條件 - Monitoring Windows Logons with Winlogbeat。