xml - Trying to understand XPATH Filtering for Windows Event Logs (XML)
问题描述
So right now I am trying to set up and configure Windows Event Collection by using a Collector Initiated Subscription. Currently, I am only collecting Security Event Logs 4624 and 4688. I'm seeing a lot of noise from just random accounts that log into the boxes for certain purposes. I wanted to figure out a way to filter out these specific account names so the subscription service ignores them.
Current XML file is:
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">*[System[(EventID=4624 or EventID=4688)]]</Select>
</Query>
</QueryList>
Event Log XML is the below. But I don't want my Windows Event Collector to collect any logs that have "0xluka" in the "Target User Name" field.
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event" xml:lang="en-US">
- <System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="" />
<EventID>4624</EventID>
<Version>2</Version>
<Level>0</Level>
<Task>12544</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2019-10-23T20:19:06.533771900Z" />
<EventRecordID>963937830</EventRecordID>
<Correlation ActivityID="" />
<Execution ProcessID="640" ThreadID="15576" />
<Channel>Security</Channel>
<Computer>0xluka.localdomain.com</Computer>
<Security />
</System>
- <EventData>
<Data Name="SubjectUserSid"></Data>
<Data Name="SubjectUserName">-</Data>
<Data Name="SubjectDomainName">-</Data>
<Data Name="SubjectLogonId">0x0</Data>
<Data Name="TargetUserSid"></Data>
<Data Name="TargetUserName">0xluka</Data>
<Data Name="TargetDomainName"></Data>
<Data Name="TargetLogonId"></Data>
<Data Name="LogonType">3</Data>
<Data Name="LogonProcessName">NtLmSsp</Data>
<Data Name="AuthenticationPackageName">NTLM</Data>
<Data Name="WorkstationName"></Data>
<Data Name="LogonGuid"></Data>
<Data Name="TransmittedServices">-</Data>
<Data Name="LmPackageName">NTLM V2</Data>
<Data Name="KeyLength">0</Data>
<Data Name="ProcessId">0x0</Data>
<Data Name="ProcessName">-</Data>
<Data Name="IpAddress"></Data>
<Data Name="IpPort"></Data>
<Data Name="ImpersonationLevel">%%1833</Data>
<Data Name="RestrictedAdminMode">-</Data>
<Data Name="TargetOutboundUserName">-</Data>
<Data Name="TargetOutboundDomainName">-</Data>
<Data Name="VirtualAccount">%%1843</Data>
<Data Name="TargetLinkedLogonId">0x0</Data>
<Data Name="ElevatedToken">%%1842</Data>
</EventData>
- <RenderingInfo Culture="en-US">
<Message>An account was successfully logged on. </Message>
<Level>Information</Level>
<Task>Logon</Task>
<Opcode>Info</Opcode>
<Channel>Security</Channel>
<Provider>Microsoft Windows security auditing.</Provider>
- <Keywords>
<Keyword>Audit Success</Keyword>
</Keywords>
</RenderingInfo>
</Event>
解决方案
您可以通过向现有 xpath 添加另一个条件来排除它targetusername
。
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">*[System[(EventID=4624 or EventID=4688)]] and
*[EventData[Data[@Name='TargetUserName'] and (Data!='0xluka')]]
</Select>
</Query>
</QueryList>
推荐阅读
- linux - SSH 隧道 - 通道 2:打开失败:管理禁止 - Ubuntu 18.4 VM
- git - 由于默认设置,从 VSCode Remote-Container 到 AWS CodeCommit 存储库的连接失败
- c# - AutoRespond to Yes No dialogs in c# like try catch for errors
- swift - 为什么将函数类型转换为 AnyObject 有效
- r - R:如何在函数本地环境中保存所有对象?
- swift - 如何使用 UIDraginInteraction 开始拖动 UIImage?
- sql-server - 多行文件的 SSIS 表达式构建器(执行流程任务)
- karate - 空手道 API - 带有模糊匹配 #number 的断言
- kubernetes - istio 因“检查应用程序端口失败”而失败
- mysql - 如何将这 3 个不同的查询合并为一个?