• Open Source Endpoint monitoring
  • https://github.com/DearBytes/Opensource-Endpoint-Monitoring

• Win7sp1 sysmon vm 환경 실행

• Win7sp1 sysmon vm 환경에서 sysmon 서비스 실행(관리자 계정)

  sysmon.exe -i %configfile% (기존에 설치했다면 필요 없음)

• Win7sp1 sysmon vm 환경에서 winlogbeat 실행(관리자 계정)

  winlogbeat.exe -c winlogbeat.yml

• Elastic Kibana 실행(관리자 계정)

  bin/kibana.bat

• Elasticsearch 실행(관리자 계정)

  bin/elasticsearch.bat

• Ubuntu 18.04 64bit 환경에서 Elasticalert 실행

  /elastalert
  elastalert --verbose --start --config <config.yaml> --rule <error.yaml>

• sysmon

  https://github.com/trustedsec/SysmonCommunityGuide/blob/master/Sysmon.md

• elastic

  https://www.elastic.co/guide/en/elastic-stack-get-started/7.6/get-started-elastic-stack.html#install-elasticsearch

• elastalert

  https://elastalert.readthedocs.io/en/latest/running_elastalert.html

[[ windows 7 ]]

• sysmon 10.x 실행 오류

  kb2533623 설치 (wevtapi.dll 문제)

  kb3033929 설치

• sysmon-config.xml

  변경전

  <PipeEvent onmatch="exclude">

  <EVENTID condition="is">1</EVENTID>

  </PipeEvent>

  변경후

  <PipeEvent onmatch="include">

  삭제

  </PipeEvent>

  변경전

  <WmiEvent onmatch="include">

  <Operation condition="is">Created</Operation>

  </WmiEvent>

  변경후

  <WmiEvent onmatch="include">

  삭제

  </WmiEvent>

[[ Elasticsearch ]]

• network.host 설정 bootstrap checks failed

  https://soye0n.tistory.com/178

[[ Elastalert ]]

• pip install 오류

  python version 3.6 다운