Monitoring Active Directory with ELK

Can you tell me where this account is getting locked out from? is a frequent question that I would get often by Help Desk, or anyone in general; therefore, I decided to come up with a user-friendly Kibana dashboard where this information could be displayed.

This is an example of a dashboard that we can create once we have all the data we need.

Login Failure & Account Lockout

Overall  login activity

Our configuration will take care of the following:

1. Remove the message field for certain event IDs such as Event ID 4625, or 4634 etc as the messages are long and repeat often which will impact your disk space. Besides you already have the fields you need to create your dashboard.
2. Removes ::ffff from IP address fields. Sometimes certain IP fields will capture the data as :::ffff followed by the actual IP address, we want to display the IPV4 only.
3. Adds context to event IDs that belong to Security Group Management Active Directory Login Types, and other Status messages related to accounts.

Here’s the Logstash configuration:

input {
  beats {
    port => 5050
	tags => [ "winlogbeat" ]
  }
}


# Removes ::ffff from IP address 
filter {
  if "winlogbeat" in [tags] {
  mutate {
    gsub => ["[event_data][IpAddress]", "::ffff:", ""]
  }
}
}


#Active Directory Logon 
filter {
  if "winlogbeat" in [tags] and [log_name] == "Security" and [event_id] == 4624 or [event_id] == 4634 {
   mutate { 
   remove_field => ["[message]"] 
   add_field => { "short_message" => "Logon Activity" }
  } 
 }
}

#Active Directory Logon Failure
filter {
  if "winlogbeat" in [tags] and [log_name] == "Security" and [event_id] == 4625 {
   mutate { 
   remove_field => ["[message]"] 
   add_field => { "short_message" => "Logon Failure Activity" }
  } 
 }
}



#Active Directory Logon - Event ID 4648 - A logon was attempted using explicit credentials.
filter {
  if "winlogbeat" in [tags] and [log_name] == "Security" and [event_id] == 4648 {
   mutate { 
   remove_field => ["[message]"] 
   add_field => { "short_message" => "A logon was attempted using explicit credentials" }
  } 
 }
}



# Active Directory - Security Group Management


filter {
  if "winlogbeat" in [tags] and [log_name] == "Security" and [event_id] == 4727  {
   mutate { 
   add_field => { "short_message" => "A security-enabled global group was created" }
  } 
 }
 else if [event_id] == 4728 {
   mutate { 
   add_field => { "short_message" => "A member was added to a security-enabled global group" }
  } 
 }
 else if [event_id] == 4729 {
   mutate { 
   add_field => { "short_message" => "A member was removed from a security-enabled global group" }
  } 
 }
 else if [event_id] == 4730 {
   mutate { 
   add_field => { "short_message" => "A security-enabled global group was deleted" }
  } 
 }
 else if [event_id] == 4731 {
   mutate { 
   add_field => { "short_message" => "A security-enabled local group was created" }
  } 
 }
 else if [event_id] == 4732 {
   mutate { 
   add_field => { "short_message" => "A member was added to a security-enabled local group" }
  } 
 }
 else if [event_id] == 4733 {
   mutate { 
   add_field => { "short_message" => "A member was removed from a security-enabled local group" }
  } 
 }
 else if [event_id] == 4734  {
   mutate { 
   add_field => { "short_message" => "A security-enabled local group was deleted" }
  } 
 }
 else if [event_id] == 4735 {
   mutate { 
   add_field => { "short_message" => "A security-enabled local group was changed" }
  } 
 }
 else if [event_id] == 4737 {
   mutate { 
   add_field => { "short_message" => "A security-enabled global group was changed" }
  } 
 }
 else if [event_id] == 4754 {
   mutate { 
   add_field => { "short_message" => "A security-enabled universal group was created" }
  } 
 }
 else if [event_id] == 4755 {
   mutate { 
   add_field => { "short_message" => "A security-enabled universal group was changed" }
  } 
 }
 else if [event_id] == 4756 {
   mutate { 
   add_field => { "short_message" => "A member was added to a security-enabled universal group" }
  } 
 }
 else if [event_id] == 4757 {
   mutate { 
   add_field => { "short_message" => "A member was removed from a security-enabled universal group" }
  } 
 }
 else if [event_id] == 4758 {
   mutate { 
   add_field => { "short_message" => "A security-enabled universal group was deleted" }
  } 
 }
 else if [event_id] == 4764 {
   mutate { 
   add_field => { "short_message" => "A group's type was changed" }
  } 
 }
 
}


#Active Directory Login Types for Event id 4624,4634,4525
# Refence http://techgenix.com/logon-types/ 
filter {
  if "winlogbeat" in [tags] and [log_name] == "Security" and [event_data][LogonType] == "2" {
   mutate { 
   add_field => { "Method" => "Interactive - Keyboard" }
  } 
 }
 else if [event_data][LogonType] == "3" {
   mutate { 
   add_field => { "Method" => "Network Logon" } 
 }
 }
 else if [event_data][LogonType] == "4" {
   mutate { 
   add_field => { "Method" => "Batch - Scheduled Task" }
  } 
 }
 else if [event_data][LogonType] == "5" {
   mutate { 
   add_field => { "Method" => "Service Account" }
  } 
 }
 else if [event_data][LogonType] == "7" {
   mutate { 
   add_field => { "Method" => "Unlock System" }
  } 
 }
 else if [event_data][LogonType] == "8" {
   mutate { 
   add_field => { "Method" => "NetworkCleartext" }
  } 
 }
 else if [event_data][LogonType] == "9" {
   mutate { 
   add_field => { "Method" => "NewCredentials" }
  } 
 }
 else if [event_data][LogonType] == "10" {
   mutate { 
   add_field => { "Method" => "RemoteInteractive" }
  } 
 }
 else if [event_data][LogonType] == "11" {
   mutate { 
   add_field => { "Method" => "CachedInteractive" }
  } 
 }
 
 else if [event_data][LogonType] == "0" {
   mutate { 
   add_field => { "Method" => "System Account" }
  } 
 }

}




#Active Directory Login Types for Event id 4771,4776,4769,4768,
#Reference this https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4776 

filter {
  if "winlogbeat" in [tags] and [log_name] == "Security" and [event_data][Status] == "0x0" {
   mutate { 
   add_field => { "Statusmsg" => "Success" }
  } 
 }
 else if [event_data][Status] == "0x12" {
   mutate { 
   add_field => { "Statusmsg" => "Account: disabled,expired,locked out,logon hours" } 
 }
 }
  else if [event_data][Status] == "0xB" {
   mutate { 
   add_field => { "Statusmsg" => "Request start time is later than end time" }
  } 
 }
 else if [event_data][Status] == "0x17" {
   mutate { 
   add_field => { "Statusmsg" => "Password has expired" }
  } 
 }
 else if [event_data][Status] == "0x18" {
   mutate { 
   add_field => { "Statusmsg" => "Bad password" }
  } 
 }
 else if [event_data][Status] == "0x1b" {
   mutate { 
   add_field => { "Statusmsg" => "Server principal valid for user-to-user only" }
  } 
 } 
 else if [event_data][Status] == "0x1d" {
   mutate { 
   add_field => { "Statusmsg" => "A service is not available." }
  } 
 }
 else if [event_data][Status] == "0x20" {
   mutate { 
   add_field => { "Statusmsg" => "Ticket expired- Frequently logged by computer accounts" }
  } 
 }
 else if [event_data][Status] == "0x25" {
   mutate { 
   add_field => { "Statusmsg" => "Workstation’s clock out of sync with the DC" }
  } 
 }
 else if [event_data][Status] == "0x6" {
   mutate { 
   add_field => { "Statusmsg" => "Username does not exist or has not replicated" }
  } 
 }
 else if [event_data][Status] == "0xc000006a" {
   mutate { 
   add_field => { "Statusmsg" => "Incorrect Password" }
  } 
 }
 else if [event_data][Status] == "0xc0000064" {
   mutate { 
   add_field => { "Statusmsg" => "Username Does Not Exist" }
  } 
 }
 
 else if [event_data][Status] == "0xc0000072" {
   mutate { 
   add_field => { "Statusmsg" => "Account is disabled" }
  } 
 }
 
 else if [event_data][Status] == "0xc0000234" {
   mutate { 
   add_field => { "Statusmsg" => "Account is Locked Out" }
  } 
 }
 
 else if [event_data][Status] == "0xc0000193" {
   mutate { 
   add_field => { "Statusmsg" => "Account Expiration" }
  } 
 }
 
 else if [event_data][Status] == "0xc000006f" {
   mutate { 
   add_field => { "Statusmsg" => "Logon Outside Hours" }
  } 
 }
 
 else if [event_data][Status] == "0xc0000224" {
   mutate { 
   add_field => { "Statusmsg" => "Use Required to change password next time" }
  } 
 }
 
 
 else if [event_data][Status] == "0xc0000071" {
   mutate { 
   add_field => { "Statusmsg" => "Password expired" }
  } 
 }
 
# related to event id: 4625

 else if [event_data][Status] == "0xc000006d" {
   mutate { 
   add_field => { "Statusmsg" => "Logon Failure" }
  } 
 }
 
 else if [event_data][Status] == "0xc000006e" {
   mutate { 
   add_field => { "Statusmsg" => "Unknown user name or bad password." }
  } 
 }
 
 else if [event_data][Status] == "0xc000005e" {
   mutate { 
   add_field => { "Statusmsg" => "No Logon Servers available to login" }
  } 
 }
 
 else if [event_data][Status] == "0xc0000133" {
   mutate { 
   add_field => { "Statusmsg" => "Workstation’s clock out of sync with the DC" }
  } 
 }

 else if [event_data][Status] == "0xc00002ee" {
   mutate { 
   add_field => { "Statusmsg" => "An Error occured during Logon" }
  } 
 }
 
  else if [event_data][Status] == "0xc000015b" {
   mutate { 
   add_field => { "Statusmsg" => "Login Not Allowed for this system" }
  } 
 }
 
  else if [event_data][Status] == "0xc0000225" {
   mutate { 
   add_field => { "Statusmsg" => "Windows Bug and not a risk" }
  } 
 }
 
}


######################### End of Active Directory Security Logs ############################


output {
if "winlogbeat" in [tags] and [log_name] == "Security" {
    elasticsearch {
    hosts => ["http://yoursecuritylogselk:9200"]
	index => "logstash-winsecurity-%{+xxxx.ww}"

  }
 }
#	old index format: index => "logstash-winlogbeat-%{+YYYY.MM.dd}"
else if "winlogbeat" in [tags] {
 elasticsearch {
    hosts => ["http://yourelk:9200"]
	index => "logstash-winlogbeat-%{+xxxx.ww}"

  }
}

}

The configuration above sends all Security-related logs to it’s own Elasticsearch server and the rest to another server, you may change the output as you like.

Here’s some basic steps on creating a Failed Login visualization:

On Kibana Navigate to Visualize > Create New visualization > Select Data Table and select your index.

type: event_id: 4625 and add the following fields:

• event_data.TargetUserName.keyword = Username
• event_data.WorkstationName.keyword = Source Computername
• event_data.IpAddress.keyword = Source IPAddress

Generate and save your visualization.

You should be able to create other dashboards that satisfy what you are looking for to ensure you are monitoring your environment.

Other suggested dashboards include:

• Account Creation
• Account Disabling & Deletion
• Account Password Reset
• Kerberos Connections – Such as SMB
• Security Group Management

Thanks for reading!

Since you read this far……

These are the Security-related Event IDs that I’m capturing from most generated to least generated events: