Windows server 共享的文件操作日志默认是没有打开的，需要手动打开，本篇文章将详细说明如何打开。并且如何将这个日志输出到ELK日志系统中。
手动打开操作日志1、打开你的共享审核功能
举例：我需要监控D盘的文件读取、写入、删除等操作
- 右键D盘属性
安全 高级 审核 继续
添加需要监视的用户跟权限，操作如下
2、设置本地安全策略
进入本地安全策略
如下图找到「审批对象访问」，双击修改属性为成功
3、测试是否成功
进入刚刚设置了审核的目录，我这进入D盘，在D盘下创建文件或目录，然后将它删除。操作完后如下查看确认是否有日志存在
- 打开事件查看器
- 单击进入安全
- 日志太多筛选一下日志，如下图
- 刚我将「 D:测试共享盘可删\新建文件夹\2023-02-08 」删除了，可以看一下我的日志信息如下：
将日志传到ELK日志系统
假设目前你已经有一套ELK系统了，直接跳过。不会的可以看一下我的历史文章
rpm+二进制包部署ELK
Docker部署ELK
1、安装winlogbeat
- 下载软件
我已将我的包上传到云盘了，有需要点我下载
- 解压 将文件夹放至长期不动的固定目录下（只是建议），例如我这放到
C:\Program Files下 - 进入文件夹，双击修改
winlogbeat.yml文件，需要修改的配置都有用中文注释了如下
###################### Winlogbeat Configuration Example ######################### This file is an example configuration file highlighting only the most common# options. The winlogbeat.reference.yml file from the same directory contains# all the supported options with more comments. You can use it as a reference.## You can find the full configuration reference here:# https://www.elastic.co/guide/en/beats/winlogbeat/index.html# ======================== Winlogbeat specific options =========================# event_logs specifies a list of event logs to monitor as well as any# accompanying options. The YAML data type of event_logs is a list of# dictionaries.## The supported keys are name (required), tags, fields, fields_under_root,# forwarded, ignore_older, level, event_id, provider, and include_xml. Please# visit the documentation for the complete details of each option.# https://go.es.io/WinlogbeatConfigwinlogbeat.event_logs: - name: Application ignore_older: 72h - name: System - name: Security processors: - script: lang: javascript id: security file: ${path.home}/module/security/config/winlogbeat-security.js - name: Microsoft-Windows-Sysmon/Operational processors: - script: lang: javascript id: sysmon file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js - name: Windows PowerShell event_id: 400, 403, 600, 800 processors: - script: lang: javascript id: powershell file: ${path.home}/module/powershell/config/winlogbeat-powershell.js - name: Microsoft-Windows-PowerShell/Operational event_id: 4103, 4104, 4105, 4106 processors: - script: lang: javascript id: powershell file: ${path.home}/module/powershell/config/winlogbeat-powershell.js - name: ForwardedEvents tags: [forwarded] processors: - script: when.equals.winlog.channel: Security lang: javascript id: security file: ${path.home}/module/security/config/winlogbeat-security.js - script: when.equals.winlog.channel: Microsoft-Windows-Sysmon/Operational lang: javascript id: sysmon file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js - script: when.equals.winlog.channel: Windows PowerShell lang: javascript id: powershell file: ${path.home}/module/powershell/config/winlogbeat-powershell.js - script: when.equals.winlog.channel: Microsoft-Windows-PowerShell/Operational lang: javascript id: powershell file: ${path.home}/module/powershell/config/winlogbeat-powershell.js# ====================== Elasticsearch template settings =======================setup.template.settings: index.number_of_shards: 1 #index.codec: best_compression #_source.enabled: false# setup.template.enabled: true# setup.template.overwrite: true # setup.dashboards.index: "share-*"# setup.ilm.enabled: false# ================================== General ===================================# The name of the shipper that publishes the network data. It can be used to group# all the transactions sent by a single shipper in the web interface.#name:# The tags of the shipper are included in their own field with each# transaction published.#tags: ["service-X", "web-tier"]# Optional fields that you can specify to add additional information to the# output.#fields:# env: staging# ================================= Dashboards =================================# These settings control loading the sample dashboards to the Kibana index. Loading# the dashboards is disabled by default and can be enabled either by setting the# options here or by using the `setup` command.#setup.dashboards.enabled: false# The URL from where to download the dashboards archive. By default this URL# has a value which is computed based on the Beat name and version. For released# versions, this URL points to the dashboard archive on the artifacts.elastic.co# website.#setup.dashboards.url:# =================================== Kibana ===================================# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.# This requires a Kibana endpoint configuration.setup.kibana: # Kibana Host # Scheme and port can be left out and will be set to the default (http and 5601) # In case you specify and additional path, the scheme is required: http://localhost:5601/path # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601 #host: "localhost:5601" # Kibana Space ID # ID of the Kibana Space into which the dashboards should be loaded. By default, # the Default Space will be used. #space.id:# =============================== Elastic Cloud ================================# These settings simplify using Winlogbeat with the Elastic Cloud (https://cloud.elastic.co/).# The cloud.id setting overwrites the `output.elasticsearch.hosts` and# `setup.kibana.host` options.# You can find the `cloud.id` in the Elastic Cloud web UI.#cloud.id:# The cloud.auth setting overwrites the `output.elasticsearch.username` and# `output.elasticsearch.password` settings. The format is `:`.#cloud.auth:# ================================== Outputs ===================================# Configure what output to use when sending the data collected by the beat.# ---------------------------- Elasticsearch Output ----------------------------output.elasticsearch: # Array of hosts to connect to. # 修改为你的es IP地址，如果你是es集群的话拿都需要加进来。例如我ES集群中有三台那么便都添加了。 hosts: ["10.11.48.159:9200","10.12.48.161:9200","10.13.48.160:9200"] # 修改存入的ES索引名称，默认索引名称是 winlogbeat开头的，可能你有多个winlogbeat那么名称会冲突，建议修改。 index: "share-%{+yyyy.MM.dd}" # Protocol - either `http` (default) or `https`. #protocol: "https" # Authentication credentials - either API key or username/password. #api_key: "id:api_key" #username: "elastic" #password: "changeme"# ------------------------------ Logstash Output -------------------------------#output.logstash: # The Logstash hosts #hosts: ["localhost:5044"] # Optional SSL. By default is off. # List of root certificates for HTTPS server verifications #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"] # Certificate for SSL client authentication #ssl.certificate: "/etc/pki/client/cert.pem" # Client Certificate Key #ssl.key: "/etc/pki/client/cert.key"# ================================= Processors =================================processors: - add_host_metadata: when.not.contains.tags: forwarded - add_cloud_metadata: ~# ================================== Logging ===================================# Sets log level. The default log level is info.# Available log levels are: error, warning, info, debug#logging.level: debug# At debug level, you can selectively enable logging only for some components.# To enable all selectors use ["*"]. Examples of other selectors are "beat",# "publisher", "service".#logging.selectors: ["*"]# ============================= X-Pack Monitoring ==============================# Winlogbeat can export internal metrics to a central Elasticsearch monitoring# cluster. This requires xpack monitoring to be enabled in Elasticsearch. The# reporting is disabled by default.# Set to true to enable the monitoring reporter.#monitoring.enabled: false# Sets the UUID of the Elasticsearch cluster under which monitoring data for this# Winlogbeat instance will appear in the Stack Monitoring UI. If output.elasticsearch# is enabled, the UUID is derived from the Elasticsearch cluster referenced by output.elasticsearch.#monitoring.cluster_uuid:# Uncomment to send the metrics to Elasticsearch. Most settings from the# Elasticsearch output are accepted here as well.# Note that the settings should point to your Elasticsearch *monitoring* cluster.# Any setting that is not set is automatically inherited from the Elasticsearch# output configuration, so if you have the Elasticsearch output configured such# that it is pointing to your Elasticsearch monitoring cluster, you can simply# uncomment the following line.#monitoring.elasticsearch:# ============================== Instrumentation ===============================# Instrumentation support for the winlogbeat.#instrumentation: # Set to true to enable instrumentation of winlogbeat. #enabled: false # Environment in which winlogbeat is running on (eg: staging, production, etc.) #environment: "" # APM Server hosts to report instrumentation results to. #hosts: # - http://localhost:8200 # API Key for the APM Server(s). # If api_key is set then secret_token will be ignored. #api_key: # Secret token for the APM Server(s). #secret_token:# ================================= Migration ==================================# This allows to enable 6.7 migration aliases#migration.6_to_7.enabled: true# 如果你修改了索引名称则以下配置也需要增加，不然无法生效。这里的share命名需与上面的index命名前缀一致。setup.template.enabled: truesetup.template.overwrite: truesetup.template.name: "share" setup.template.pattern: "share-*" setup.ilm.enabled: false- 检查配置
# 进入目录cd "C:\Program Files\winlogbeat-7.13.0-windows-x86_64".\winlogbeat.exe test config -c .\winlogbeat.yml -e检查期间如果提示为OK，说明配置文件没问题
- 输入一下命令启动
# 进入目录cd "C:\Program Files\winlogbeat-7.13.0-windows-x86_64"# 执行下面命令后，需要输入Y，回车。启用执行不信任的脚本功能Set-ExecutionPolicy -ExecutionPolicy RemoteSigned# 将winlogbeat注册成系统服务.\install-service-winlogbeat.ps1# 启动Start-Service winlogbeat- 检查确认
需要确认两个地方分别是：
- 在Windows winlogbeat 是否启动
- kibana是否存在了刚才创建的索引
- 测试
删除或者创建文件，然后在kibana中搜索。搜索删除语法event.code:"4663" and message : DELETE
PS：kibana的使用自行探索，在此不做介绍了哦
参考链接
https://blog.csdn.net/yk20091201/article/details/90756738
https://www.cnblogs.com/lhxsoft/p/15994432.html
https://blog.csdn.net/weixin_43719616/article/details/114790067
https://iminto.github.io/post/filebeat%E4%BF%AE%E6%94%B9index%E7%9A%84%E4%B8%80%E4%B8%AA%E5%9D%91/
https://blog.51cto.com/studyit2016/2084858
https://www.doit.com.cn/p/137278.html