Windows log Filtering

Windows log Filtering

File system auditing is turned on because the Windows Log Manager is not easy to filter, so use the PowerShell method for filtering.

First, demand analysis

• There is a problem

  1. Huge log volume (about 1G per day)
  2. Log Manager query log inconvenience

• Main objectives

  1. Enable File system auditing
  2. Delete operation for quick query user
• Solution Solutions
  1. Archive logs with rotation (500MB)
  2. Logs are stored for 60 days (scripts can be deleted beyond the deadline log archive)
  3. Use Filterxpath in get-winevent to filter, format print
  4. The delete opcode is 0x10000 and can be filtered

Second, file audit settings 2.1 to open the File system audit function

1. Secpol.msc
2. Advanced Audit Policy Configuration
3. Object Access
4. Audit File System
   • [x] Configure the following audit events:
   • [x] Success
   • [x] Failure

2.2 Creating a shared folder

1. Folder Properties
2. Sharing
3. Choose people to share with
4. Everyone

2.3 Set user groups for folder auditing

1. Folder Properties
2. Security
3. Advanced
4. Auditing
5. ADD User

Third, the method

• Filter Event ID is 4460 log

PS C:\Windows\system32>  Get-WinEvent -LogName Security -FilterXPath "*[System[EventID=4660]]"   ProviderName: Microsoft-Windows-Security-AuditingTimeCreated                     Id LevelDisplayName Message-----------                     -- ---------------- -------5/22/2018 10:01:37 AM         4660 Information      An object was deleted....5/22/2018 9:03:11 AM          4660 Information      An object was deleted....

• Filter file Delete Log

PS C:\Windows\system32> Get-WinEvent -LogName "Security" -FilterXPath "*[EventData[Data[@Name=‘AccessMask‘]=‘0x10000‘]]"   ProviderName: Microsoft-Windows-Security-AuditingTimeCreated                     Id LevelDisplayName Message-----------                     -- ---------------- -------5/22/2018 10:01:37 AM         4663 Information      An attempt was made to access an object....5/22/2018 9:03:11 AM          4663 Information      An attempt was made to access an object....

• Filter the specified user file delete log

PS C:\Windows\system32> Get-WinEvent -LogName "Security" -FilterXPath "*[EventData[Data[@Name=‘AccessMask‘]=‘0x10000‘]] and *[EventData[Data[@Name=‘SubjectUserName‘]=‘lxy‘]]"   ProviderName: Microsoft-Windows-Security-AuditingTimeCreated                     Id LevelDisplayName Message-----------                     -- ---------------- -------5/22/2018 9:03:11 AM          4663 Information      An attempt was made to access an object....

• Filter the specified user file delete log in variable mode

PS C:\Windows\system32> $AccessMask=‘0x10000‘PS C:\Windows\system32> $UserName=‘lxy‘PS C:\Windows\system32> Get-WinEvent -LogName "Security" -FilterXPath "*[EventData[Data[@Name=‘AccessMask‘]=‘$AccessMask‘]] and *[EventData[Data[@Name=‘SubjectUserName‘]=‘$UserName‘]]"   ProviderName: Microsoft-Windows-Security-AuditingTimeCreated                     Id LevelDisplayName Message-----------                     -- ---------------- -------5/22/2018 9:03:11 AM          4663 Information      An attempt was made to access an object....

• To delete a log from a saved file filter file

PS C:\Users\F2844290> Get-WinEvent -Path ‘C:\Users\F2844290\Desktop\SaveSec.evtx‘ -FilterXPath "*[EventData[Data[@Name=‘AccessMask‘]=‘0x10000‘]]"PS C:\Windows\system32> $AccessMask=‘0x10000‘

• filter security logs that occur within 10 minutes
  The time calculation unit in XML is ms,10minute=60 1000=600000

PS C:\Windows\system32> Get-WinEvent -LogName Security -FilterXPath "*[System[TimeCreated[timediff(@SystemTime) < 600000]]]"   ProviderName: Microsoft-Windows-Security-AuditingTimeCreated                     Id LevelDisplayName Message-----------                     -- ---------------- -------5/22/2018 4:11:30 PM          4663 Information      An attempt was made to access an object....5/22/2018 4:11:30 PM          4663 Information      An attempt was made to access an object....5/22/2018 4:11:30 PM          4663 Information      An attempt was made to access an object....5/22/2018 4:11:30 PM          4663 Information      An attempt was made to access an object....

• Other

If you have an ambiguous syntax, refer to the XML method in the log manager that filters the current log.

Iv. Other documents

• File Delete log structure

Log name:securitysource:microsoft-windows-security-auditingdate:5/22/2018 9:03:11 AMEvent ID: 4663Task category:file SystemLevel:InformationKeywords:Audit successuser:n/acomputer:idx- St-05description:an attempt was made to access an object.       Subject:security id:idx-st-05\lxy Account name:lxy account domain:idx-st-05 Logon ID: 0x2ed3b8object:object server:security Object Type:file object Name:c:\data\net.txt Handle id:0  X444process information:process id:0x4 Process name:access Request Information:Accesses:DELETE Access    Mask:0x10000event xml:<event xmlns= "Http://schemas.microsoft.com/win/2004/08/events/event" > <System> <provider name= "microsoft-windows-security-auditing" guid= "{54849625-5478-4994-a5ba-3e3b0328c30d}"/> < Eventid>4663</eventid> <Version>0</Version> <level>0</level&Gt <Task>12800</Task> <Opcode>0</Opcode> <keywords>0x8020000000000000</keywords > <timecreated systemtime= "2018-05-22t01:03:11.876720000z"/> <eventrecordid>1514</eventrecordid > <correlation/> <execution processid= "4" threadid= "" "/> <channel>security</channel&gt    ; <Computer>IDX-ST-05</Computer> <security/> </System> <EventData> <data name= "Sub Jectusersid ">S-1-5-21-1815651738-4066643265-3072818021-1004</Data> <data name=" Subjectusername "> lxy</data> <data name= "Subjectdomainname" >IDX-ST-05</Data> <data name= "Subjectlogonid" > 0x2ed3b8</data> <data name= "objectserver" >Security</Data> <data name= "ObjectType" >File< /data> <data name= "ObjectName" >C:\Data\net.txt</Data> <data name= "Handleid" >0x444</data > <data name= "accesslist" >%%1537 </Data> <data name= "AccessMask" >0x10000</Data> <data name= "ProcessId" >0x4 </Data> <data name= "ProcessName" > </Data> </EventData></Event>

• File Operation Code Table

File ReadAccesses: ReadData (or ListDirectory)AccessMask: 0x1File WriteAccesses: WriteData (or AddFile)AccessMask: 0x2File DeleteAccesses: DELETEAccessMask: 0x10000File RenameAccesses: DELETEAccessMask: 0x10000File CopyAccesses: ReadData (or ListDirectory)AccessMask: 0x1File Permissions ChangeAccesses: WRITE_DACAccessMask: 0x40000File Ownership ChangeAccesses: WRITE_OWNERAccessMask: 0x80000

Windows log Filtering