-
Notifications
You must be signed in to change notification settings - Fork 4.9k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add 4634 and 4647 (logoff events) to Security module (#12906)
This adds event ID 4634 and 4647 (logoff events) to the Security module. It also adds winlog.logon.type which is a descriptive version of the winlog.event_data.LogonType field. Co-authored-by: Anabella Cristaldi <anabella.cristaldi@gmail.com> Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>
- Loading branch information
3 people
committed
Jul 18, 2019
1 parent
833c022
commit 192f523
Showing
10 changed files
with
204 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file added
BIN
+68 KB
x-pack/winlogbeat/module/security/test/testdata/security-windows2016-logoff.evtx
Binary file not shown.
90 changes: 90 additions & 0 deletions
90
x-pack/winlogbeat/module/security/test/testdata/security-windows2016-logoff.evtx.golden.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,90 @@ | ||
| [ | ||
| { | ||
| "@timestamp": "2019-05-17T11:06:58.210768Z", | ||
| "event": { | ||
| "action": "Logoff", | ||
| "code": 4634, | ||
| "kind": "event" | ||
| }, | ||
| "log": { | ||
| "level": "information" | ||
| }, | ||
| "message": "An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1000\n\tAccount Name:\t\taudittest\n\tAccount Domain:\t\tWIN-41OB2LO92CR\n\tLogon ID:\t\t0x767A77\n\nLogon Type:\t\t\t3\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.", | ||
| "user": { | ||
| "domain": "WIN-41OB2LO92CR", | ||
| "id": "S-1-5-21-101361758-2486510592-3018839910-1000", | ||
| "name": "audittest" | ||
| }, | ||
| "winlog": { | ||
| "api": "wineventlog", | ||
| "channel": "Security", | ||
| "computer_name": "WIN-41OB2LO92CR", | ||
| "event_data": { | ||
| "LogonType": "3", | ||
| "TargetLogonId": "0x767a77" | ||
| }, | ||
| "event_id": 4634, | ||
| "keywords": [ | ||
| "Audit Success" | ||
| ], | ||
| "logon": { | ||
| "type": "Network" | ||
| }, | ||
| "opcode": "Info", | ||
| "process": { | ||
| "pid": 776, | ||
| "thread": { | ||
| "id": 540 | ||
| } | ||
| }, | ||
| "provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}", | ||
| "provider_name": "Microsoft-Windows-Security-Auditing", | ||
| "record_id": 485, | ||
| "task": "Logoff" | ||
| } | ||
| }, | ||
| { | ||
| "@timestamp": "2019-05-19T16:15:38.542273Z", | ||
| "event": { | ||
| "action": "Logoff", | ||
| "code": 4634, | ||
| "kind": "event" | ||
| }, | ||
| "log": { | ||
| "level": "information" | ||
| }, | ||
| "message": "An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWIN-41OB2LO92CR\n\tLogon ID:\t\t0x104A4A6\n\nLogon Type:\t\t\t3\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.", | ||
| "user": { | ||
| "domain": "WIN-41OB2LO92CR", | ||
| "id": "S-1-5-21-101361758-2486510592-3018839910-500", | ||
| "name": "Administrator" | ||
| }, | ||
| "winlog": { | ||
| "api": "wineventlog", | ||
| "channel": "Security", | ||
| "computer_name": "WIN-41OB2LO92CR", | ||
| "event_data": { | ||
| "LogonType": "3", | ||
| "TargetLogonId": "0x104a4a6" | ||
| }, | ||
| "event_id": 4634, | ||
| "keywords": [ | ||
| "Audit Success" | ||
| ], | ||
| "logon": { | ||
| "type": "Network" | ||
| }, | ||
| "opcode": "Info", | ||
| "process": { | ||
| "pid": 780, | ||
| "thread": { | ||
| "id": 820 | ||
| } | ||
| }, | ||
| "provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}", | ||
| "provider_name": "Microsoft-Windows-Security-Auditing", | ||
| "record_id": 747, | ||
| "task": "Logoff" | ||
| } | ||
| } | ||
| ] |