Winlogbeat + security module analytics: data growup

Plugins Security Analytics
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
2.7.0

Describe the issue:
hello,

i want to use sygma rule to inspect my windows domain controller. but index size is arround 30Go by day.
have you some advises or best practise to limit event to send to opensearch?

thanks

Configuration:

winlogbeat.event_logs:

  • name: Application
    ignore_older: 10m

  • name: System
    ignore_older: 10m

  • name: Security
    ignore_older: 10m
    processors:

    • script:
      lang: javascript
      id: security
      file: ${path.home}/module/security/config/winlogbeat-security.js

  • name: Microsoft-Windows-Sysmon/Operational
    ignore_older: 10m
    processors:

    • script:
      lang: javascript
      id: sysmon
      file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js

  • name: Windows PowerShell
    ignore_older: 10m
    event_id: 400, 403, 600, 800
    processors:

    • script:
      lang: javascript
      id: powershell
      file: ${path.home}/module/powershell/config/winlogbeat-powershell.js

  • name: Microsoft-Windows-PowerShell/Operational
    ignore_older: 10m
    event_id: 4103, 4104, 4105, 4106
    processors:

    • script:
      lang: javascript
      id: powershell
      file: ${path.home}/module/powershell/config/winlogbeat-powershell.js

  • name: ForwardedEvents
    ignore_older: 10m
    tags: [forwarded]
    processors:

    • script:
      when.equals.winlog.channel: Security
      lang: javascript
      id: security
      file: ${path.home}/module/security/config/winlogbeat-security.js
    • script:
      when.equals.winlog.channel: Microsoft-Windows-Sysmon/Operational
      lang: javascript
      id: sysmon
      file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js
    • script:
      when.equals.winlog.channel: Windows PowerShell
      lang: javascript
      id: powershell
      file: ${path.home}/module/powershell/config/winlogbeat-powershell.js
    • script:
      when.equals.winlog.channel: Microsoft-Windows-PowerShell/Operational
      lang: javascript
      id: powershell
      file: ${path.home}/module/powershell/config/winlogbeat-powershell.js
2

@LMaquaire This is the Security category? Do you have a security issue related to Winlogbeat or this is just Security Analytics issue?

3

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.