@@ -67,6 +67,22 @@ winlogbeat.event_logs:
|
67 | 67 | - name: WEC7-Active-Directory |
68 | 68 | - name: WEC7-Privilege-Use |
69 | 69 | - name: WEC7-Terminal-Services |
| 70 | + |
| 71 | + - name: Windows PowerShell |
| 72 | + event_id: 400, 403, 600, 800 |
| 73 | + processors: |
| 74 | + - script: |
| 75 | + lang: javascript |
| 76 | + id: powershell |
| 77 | + file: ${path.home}/module/powershell/config/winlogbeat-powershell.js |
| 78 | + |
| 79 | + - name: Microsoft-Windows-PowerShell/Operational |
| 80 | + event_id: 4103, 4104, 4105, 4106 |
| 81 | + processors: |
| 82 | + - script: |
| 83 | + lang: javascript |
| 84 | + id: powershell-operational |
| 85 | + file: ${path.home}/module/powershell/config/winlogbeat-powershell.js |
70 | 86 | |
71 | 87 | setup.kibana: |
72 | 88 | host: "192.168.38.105:5601" |
|