# Enable Windows Audit Policy & Winlogbeat

## Prerequisites:

* _**`Windows Machine`**_: [https://info.microsoft.com/ww-landing-windows-10-enterprise.html](https://info.microsoft.com/ww-landing-windows-10-enterprise.html)
* _**`Windows Server`**_: [https://info.microsoft.com/ww-landing-windows-server-2022.html](https://info.microsoft.com/ww-landing-windows-server-2022.html)
* _**`Ubuntu Machine`**_

We have successfully set up Elasticsearch and Kibana on the Ubuntu machine. The next step is to install Winlogbeat and configure it to send logs to the ELK stack. However, before proceeding with the installation, we need to apply specific policies to the Sales OU that was previously created.

* **`Process Creation Logging`:**

```sql
Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > 
System Audit Policies - Local Group Policy Object > Detailed Tracking
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FhZpmPFNZ6EwAT8EQPO3G%2FScreenshot.png?alt=media&#x26;token=6e63972e-6c95-4529-9be2-dccfa08ce614" alt=""><figcaption></figcaption></figure>

Let's call it **Audit Logging**.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FH0JA5GCkinR80R4Kh1jD%2FScreenshot(1).png?alt=media&#x26;token=63a3857e-8888-4961-9970-30818f3324a8" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FOZvjGdxx0cG5paYaTKcn%2FScreenshot(2).png?alt=media&#x26;token=988de671-6008-48d5-9948-846d5889f0ae" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FdVKQ9Awl5vOuFPzldk89%2FScreenshot(3).png?alt=media&#x26;token=be103047-33f0-430a-acc5-17dc05474cd1" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FZxo42D7jdLPPxqQcRAV9%2FScreenshot(4).png?alt=media&#x26;token=19d7518d-0dfe-4a08-af69-2b93baf64642" alt=""><figcaption></figcaption></figure>

* **`Logon and Authentication Auditing`:**

```sql
Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > 
System Audit Policies - Local Group Policy Object > Logon/Logoff
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FZKISsXrDpeIw0I0HA3FT%2FScreenshot(5).png?alt=media&#x26;token=e0bcc909-ae0f-46f9-aaff-99709b1af04a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FKicwKYFPEuTN8D0K0Uld%2FScreenshot(6).png?alt=media&#x26;token=88cd008d-c699-46fb-8146-9ac274f35776" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FkjUKFLXYCftR0mQG5m36%2FScreenshot(7).png?alt=media&#x26;token=e738786e-733e-4146-ba4c-26e9934b4e1c" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FC5FVspWX5JW9ggosaFuQ%2FScreenshot(8).png?alt=media&#x26;token=4d5eb4e9-145c-4fcb-a528-38f6decf217d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FQ6e3ejSTHsC2MVPEVGKk%2FScreenshot(9).png?alt=media&#x26;token=99bd0cfd-fafc-4993-a731-3a5cb7682ee0" alt=""><figcaption></figcaption></figure>

Next, we need to run the following command on the client machine to apply the policy:

```powershell
gpupdate /force
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FkURB0bwDYdsVx7fQbJML%2FScreenshot(10).png?alt=media&#x26;token=b69dcb7a-a697-40d9-a4f6-33d6fd3fd793" alt=""><figcaption></figcaption></figure>

Next, we need to configure Winlogbeat on the Windows Client.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FBagWwuPrho4oHcrhUZXa%2FScreenshot(11).png?alt=media&#x26;token=79e96b7e-b1be-4c2f-b805-b0262e897045" alt=""><figcaption></figcaption></figure>

Next, let's start the service:

```powershell
Start-Service winlogbeat
Get-service winlogbeat
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F6ZdGL5Sej3T4L7NCF2QZ%2FScreenshot(12).png?alt=media&#x26;token=d2ebfc89-2762-4a79-9709-ae8f726ce262" alt=""><figcaption></figcaption></figure>

Next, we will proceed with testing the configuration.

```powershell
.\winlogbeat.exe test config -c .\winlogbeat.yml
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FAPZp2sz2oMlDs28D6gZc%2FScreenshot(13).png?alt=media&#x26;token=0d236945-1fbb-4e5a-b2f6-108822ede116" alt=""><figcaption></figcaption></figure>

Before sending logs, let's check the connection to the configured output (Elasticsearch) is established.

```bash
.\winlogbeat.exe test output
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FJZUWvPfzmHMdMJ8tyc1k%2FScreenshot(14).png?alt=media&#x26;token=2315dba5-61ef-438b-9bc6-ba65798452fa" alt=""><figcaption></figcaption></figure>

This command verifies if Winlogbeat can successfully send logs to the configured destination.

Next, we need to start **`Winlogbeat`** using the `winlogbeat.yml` configuration file to capture and display real-time logs in the console.

```powershell
.\winlogbeat.exe -c .\winlogbeat.yml -e
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2Fw7UxV8xzyVWgUDYuJFzG%2FScreenshot(15).png?alt=media&#x26;token=0cefafaa-bf18-4034-81c9-43086f063994" alt=""><figcaption></figcaption></figure>

* `.\winlogbeat.exe` → Runs the Winlogbeat program to collect windows logs.
* `-c .\winlogbeat.yml` → Uses the **winlogbeat.yml** file for configuration (tells Winlogbeat where to send logs, like Elasticsearch).
* `-e` → Shows log messages **on the screen** instead of saving them to a file.

We now need to confirm whether ELK successfully receives logs from **`Winlogbeat`**.

From Stack Management  → Index Management&#x20;

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FFmearKz3XhCqpsnIG96K%2FScreenshot(16).png?alt=media&#x26;token=a4b5a68d-e9f0-49e9-b5e5-60f4c93f6510" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FyNrO5N1zJcRzK7YMnWX1%2FScreenshot(17).png?alt=media&#x26;token=6a7d62a7-46aa-4c64-82b4-d376d21472b4" alt=""><figcaption></figcaption></figure>

Let's apply filters based on specific Event IDs.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F2X4sX70PIRMwZhCEcVPw%2FScreenshot(18).png?alt=media&#x26;token=5827951a-fadc-42a6-bb65-6bd234aba7f7" alt=""><figcaption></figcaption></figure>

* _**`4688`**_:A new process has been created.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FRxstQZIuiDy8EM82GA11%2FScreenshot(19).png?alt=media&#x26;token=4ef47fb5-d76a-45b7-9ab8-9de66a583a79" alt=""><figcaption></figcaption></figure>

* _**`4624`**_: An account was successfully logged on.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F1SFTm9g0ekHkO1DLx9tX%2FScreenshot(20).png?alt=media&#x26;token=e212e0a1-84c8-415d-8982-40f51c7292bb" alt=""><figcaption></figcaption></figure>

* _**`4672`**_: Special privileges assigned to new logon.

Let's create a dashboard that visualizes data of the Client01 machine.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2Ft961SAM1oauOw2327jyU%2FScreenshot(22).png?alt=media&#x26;token=6c4eb250-23eb-48a6-a51c-af5fabccb461" alt=""><figcaption></figcaption></figure>
