winlogbeat之windows日志微信报警
现有的收集AD日志架构是通过winlogbeat 发送日志到elasticsearch 我的思路是通过winlogbeat 在发送一份日志到logstash中，通过logstash中output的exec执行Python脚本发送锁定日志给用户，并引导解锁。
标签 Logstash 下的文章
Logstash - Suricata DNS and fast.log
input { file { path => [ "/mnt/logs/ids/dns.log" ] sincedb_path => "/dev/null" start_position => "beginning" #Поменять на end# tags => ["dns"] } file { path => [ "/mnt/logs/ids/fast.log" ] sincedb_path => "/dev/null" start_position => "beginning" #Поменять на end# tags => ["ids"] }
Logstash 提取SURICATA fast.log正则表达式
09/20/2020-00:18:32.710309 [**] [1:2010935:3] ET SCAN Suspicious inbound to MSSQL port 1433 [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 213.212.243.106:49614 -> 1.1.1.1:1433
通过 Logstash 将日志存入 Mysql
driver_jar_path => "/opt/mysql-connector-java-8.0.21.jar" driver_class => "com.mysql.jdbc.Driver" connection_string => "jdbc:mysql://127.0.0.1:3306/库名?user=USERNAME&password=PASSWORD&useUnicode=true&characterEncoding=UTF8"
