Windows Event Logs: Полное руководство по анализу системных событий - 150+ типов событий для расследований 2026

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />

    <EventID>4624</EventID>

    <Version>2</Version>

    <Level>0</Level>

    <Task>12544</Task>

    <Opcode>0</Opcode>

    <Keywords>0x8020000000000000</Keywords>

    <TimeCreated SystemTime="2024-01-15T10:30:45.123456789Z" />

    <EventRecordID>12345</EventRecordID>

    <Correlation />

    <Execution ProcessID="1234" ThreadID="5678" />

    <Channel>Security</Channel>

    <Computer>WORKSTATION01</Computer>

    <Security />

  </System>

  <EventData>

    <Data Name="SubjectUserSid">S-1-5-21-1234567890-1234567890-1234567890-1001</Data>

    <Data Name="SubjectUserName">Administrator</Data>

    <Data Name="SubjectDomainName">WORKSTATION01</Data>

    <!-- Дополнительные данные -->

  </EventData>

</Event>

<h2 id="prosmotr-nastroek">Просмотр настроек</h2>

Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\*"



<h2 id="nastroyka-razmera-zhurnala">Настройка размера журнала</h2>

Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security" -Name "MaxSize" -Value 268435456

<h2 id="prosmotr-zhurnalov">Просмотр журналов</h2>

Get-WinEvent -ListLog *



<h2 id="ochistka-zhurnala">Очистка журнала</h2>

Clear-EventLog -LogName System



<h2 id="arhivatsiya-zhurnala">Архивация журнала</h2>

wevtutil epl System C:\Logs\System.evtx

📁 Applications and Services Logs

├── 📁 Microsoft

│   ├── 📁 Windows

│   │   ├── 📁 Active Directory

│   │   ├── 📁 DNS Client

│   │   └── 📁 Windows Defender

│   └── 📁 Office

└── 📁 Third-party applications

<Provider Name="Microsoft-Windows-Security-Auditing" 

          Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />

<EventID>4624</EventID>

<TimeCreated SystemTime="2024-01-15T10:30:45.123456789Z" />

<EventData>

  <Data Name="SubjectUserSid">S-1-5-21-1234567890-1234567890-1234567890-1001</Data>

  <Data Name="SubjectUserName">Administrator</Data>

  <Data Name="SubjectDomainName">WORKSTATION01</Data>

  <Data Name="TargetUserSid">S-1-5-21-1234567890-1234567890-1234567890-1002</Data>

  <Data Name="TargetUserName">user1</Data>

  <Data Name="TargetDomainName">WORKSTATION01</Data>

  <Data Name="LogonType">2</Data>

  <Data Name="LogonProcessName">User32</Data>

  <Data Name="AuthenticationPackageName">Negotiate</Data>

  <Data Name="WorkstationName">WORKSTATION01</Data>

  <Data Name="LogonGuid">{12345678-1234-1234-1234-123456789012}</Data>

  <Data Name="TransmittedServices">-</Data>

  <Data Name="LmPackageName">-</Data>

  <Data Name="KeyLength">0</Data>

  <Data Name="ProcessId">0x1a4</Data>

  <Data Name="ProcessName">C:\Windows\System32\winlogon.exe</Data>

  <Data Name="IpAddress">192.168.1.100</Data>

  <Data Name="IpPort">0</Data>

</EventData>

<EventData>

  <Binary>Binary data here</Binary>

</EventData>

<UserData>

  <CustomData xmlns="http://example.com">

    <Field1>Value1</Field1>

    <Field2>Value2</Field2>

  </CustomData>

</UserData>

import datetime

import struct



def filetime_to_datetime(filetime):

    """Convert Windows FILETIME to datetime"""

    # FILETIME is in 100-nanosecond intervals since 1601-01-01

    epoch = datetime.datetime(1601, 1, 1)

    microseconds = filetime // 10

    return epoch + datetime.timedelta(microseconds=microseconds)



def systemtime_to_datetime(systemtime_str):

    """Convert SYSTEMTIME string to datetime"""

    # Format: 2024-01-15T10:30:45.123456789Z

    return datetime.datetime.fromisoformat(systemtime_str.replace('Z', '+00:00'))

def parse_sid(sid_string):

    """Parse SID string into components"""

    parts = sid_string.split('-')

    revision = int(parts[1])

    authority = int(parts[2])

    subauthorities = [int(x) for x in parts[3:]]

    return {

        'revision': revision,

        'authority': authority,

        'subauthorities': subauthorities

    }

<h2 id="filtr-po-uspeshnoy-autentifikatsii">Фильтр по успешной аутентификации</h2>

Get-WinEvent -FilterHashtable @{

    LogName = 'Security'

    ID = 4624

    Keywords = 0x8020000000000000

}

<h2 id="poluchit-shablon-sobytiya">Получить шаблон события</h2>

$template = Get-WinEvent -FilterHashtable @{

    LogName = 'Security'

    ID = 4624

} | Select-Object -First 1



$template.Message

<h2 id="otkryt-event-viewer">Открыть Event Viewer</h2>

eventvwr.msc



<h2 id="cherez-powershell">Через PowerShell</h2>

Show-EventLog

<h2 id="prosmotr-poslednih-10-sobytiy">Просмотр последних 10 событий</h2>

Get-WinEvent -LogName System -MaxEvents 10



<h2 id="filtr-po-event-id">Фильтр по Event ID</h2>

Get-WinEvent -FilterHashtable @{

    LogName = 'Security'

    ID = 4624

    StartTime = (Get-Date).AddDays(-1)

    EndTime = Get-Date()

}



<h2 id="poisk-po-soderzhimomu">Поиск по содержимому</h2>

Get-WinEvent -FilterHashtable @{

    LogName = 'Application'

    ProviderName = 'Application Error'

} | Where-Object { $_.Message -like '*error*' }

<h2 id="prosmotr-sistemnogo-zhurnala">Просмотр системного журнала</h2>

Get-EventLog -LogName System -Newest 50



<h2 id="filtr-po-tipu">Фильтр по типу</h2>

Get-EventLog -LogName Application -EntryType Error

REM Экспорт журнала

wevtutil epl System C:\Logs\System.evtx



REM Получить информацию о журнале

wevtutil gl System



REM Очистить журнал

wevtutil cl System



REM Архивация с фильтром

wevtutil epl Security /q:"*[System[TimeCreated[@SystemTime>'2024-01-01T00:00:00' and @SystemTime<'2024-12-31T23:59:59']]]" C:\Logs\Filtered_Security.evtx

<h2 id="sozdanie-keysa">Создание кейса</h2>

autopsy --create-case case_name



<h2 id="dobavlenie-obraza">Добавление образа</h2>

autopsy --add-image image.dd



<h2 id="analiz-event-logs">Анализ Event Logs</h2>

<h2 id="v-gui-file-analysis-event-logs">В GUI: File Analysis → Event Logs</h2>

REM Установка LogParser

logparser.exe -i:EVT -o:CSV "SELECT * FROM System WHERE EventID = 1001" > output.csv



REM Анализ Security лога

logparser.exe -i:EVT -o:DATAGRID "SELECT TOP 100 TimeGenerated, EventID, Message FROM Security WHERE EventTypeName = 'Audit Success'"

<h2 id="izvlechenie-sobytiy-iz-evtx-fayla">Извлечение событий из EVTX файла</h2>

evtxtract.py System.evtx > system_events.xml



<h2 id="filtratsiya-po-event-id">Фильтрация по Event ID</h2>

evtxtract.py Security.evtx | grep "<EventID>4624</EventID>"

from Evtx.Evtx import FileHeader

from Evtx.Views import evtx_file_xml_view



def parse_evtx(file_path):

    """Парсинг EVTX файла"""

    with open(file_path, 'rb') as f:

        fh = FileHeader(f, 0x0)

        for xml, record in evtx_file_xml_view(fh):

            # Обработка каждого события

            print(xml)



<h2 id="ispolzovanie">Использование</h2>

parse_evtx('Security.evtx')

<h2 id="poisk-sobytiy-vhoda">Поиск событий входа</h2>

index=windows sourcetype="WinEventLog:Security" EventCode=4624

| stats count by Account_Name, ComputerName

| sort -count



<h2 id="analiz-oshibok">Анализ ошибок</h2>

index=windows sourcetype="WinEventLog:System" EventCode=1001

| timechart count by ComputerName

input {

  file {

    path => "/var/log/windows/*.evtx"

    type => "wineventlog"

  }

}



filter {

  xml {

    source => "message"

    target => "parsed"

  }

  

  date {

    match => ["[parsed][System][TimeCreated][@SystemTime]", "ISO8601"]

    target => "@timestamp"

  }

}



output {

  elasticsearch {

    hosts => ["localhost:9200"]

    index => "windows-events-%{+YYYY.MM.dd}"

  }

}

import Evtx.Evtx as evtx



def analyze_evtx_file(file_path, event_id_filter=None):

    """Анализ EVTX файла"""

    events = []

    

    with open(file_path, 'rb') as f:

        fh = evtx.FileHeader(f, 0x0)

        

        for xml, record in evtx.views.evtx_file_xml_view(fh):

            # Парсинг XML

            root = ET.fromstring(xml)

            

            event_id = root.find('.//EventID').text

            if event_id_filter and event_id != str(event_id_filter):

                continue

                

            timestamp = root.find('.//TimeCreated').get('SystemTime')

            level = root.find('.//Level').text

            provider = root.find('.//Provider').get('Name')

            

            events.append({

                'event_id': event_id,

                'timestamp': timestamp,

                'level': level,

                'provider': provider,

                'xml': xml

            })

    

    return events



<h2 id="ispolzovanie">Использование</h2>

events = analyze_evtx_file('Security.evtx', event_id_filter=4624)

import pandas as pd

from datetime import datetime



def create_events_dataframe(events):

    """Создание DataFrame для анализа"""

    df = pd.DataFrame(events)

    

    # Парсинг временных меток

    df['timestamp'] = pd.to_datetime(df['timestamp'])

    df.set_index('timestamp', inplace=True)

    

    # Категоризация по уровням

    level_map = {

        '1': 'Critical',

        '2': 'Error', 

        '3': 'Warning',

        '4': 'Information',

        '5': 'Verbose'

    }

    df['level_name'] = df['level'].map(level_map)

    

    return df



<h2 id="analiz">Анализ</h2>

df = create_events_dataframe(events)



<h2 id="statistika-po-event-id">Статистика по Event ID</h2>

event_stats = df.groupby('event_id').size().sort_values(ascending=False)



<h2 id="analiz-po-vremeni">Анализ по времени</h2>

hourly_stats = df.resample('H').size()



<h2 id="poisk-anomaliy">Поиск аномалий</h2>

daily_avg = df.resample('D').size().mean()

anomalies = df.resample('D').size()[df.resample('D').size() > daily_avg * 2]

{

  "dashboard": {

    "title": "Windows Event Logs",

    "panels": [

      {

        "title": "Events by Level",

        "type": "piechart",

        "targets": [

          {

            "query": "SELECT level, COUNT(*) as count FROM events GROUP BY level"

          }

        ]

      },

      {

        "title": "Events Timeline",

        "type": "linechart",

        "targets": [

          {

            "query": "SELECT DATE(timestamp) as date, COUNT(*) as count FROM events GROUP BY DATE(timestamp)"

          }

        ]

      }

    ]

  }

}

<h2 id="kriticheskie-oshibki-sistemy">Критические ошибки системы</h2>

Get-WinEvent -FilterHashtable @{

    LogName = 'System'

    Level = 1,2  # Critical, Error

} -MaxEvents 50 | Format-Table TimeCreated, ID, Message -AutoSize

<h2 id="neudachnye-popytki-vhoda">Неудачные попытки входа</h2>

Get-WinEvent -FilterHashtable @{

    LogName = 'Security'

    ID = 4625  # Failed login

    StartTime = (Get-Date).AddHours(-24)

} | Select-Object TimeCreated, @{Name='Username';Expression={$_.Properties[5].Value}}, @{Name='IP';Expression={$_.Properties[18].Value}}

<h2 id="sobytiya-za-posledniy-chas">События за последний час</h2>

$lastHour = (Get-Date).AddHours(-1)

Get-WinEvent -FilterHashtable @{

    LogName = 'System'

    StartTime = $lastHour

} | Sort-Object TimeCreated -Descending

<h2 id="gruppirovka-po-chasam">Группировка по часам</h2>

Get-WinEvent -FilterHashtable @{

    LogName = 'Security'

    StartTime = (Get-Date).AddDays(-1)

} | Group-Object {$_.TimeCreated.Hour} | Sort-Object Count -Descending

$criticalEvents = @(

    1001,  # System crash

    4625,  # Failed login

    4720,  # User account created

    4723,  # Password change attempt

    4728,  # Member added to security group

    4732,  # Member added to local group

    4738,  # User account changed

    4740,  # User account locked out

    4771,  # Kerberos pre-authentication failed

    4946,  # Windows Firewall rule added

    4947,  # Windows Firewall rule modified

    4950,  # Windows Firewall setting changed

    7031,  # Service terminated unexpectedly

    7034   # Service terminated unexpectedly

)



foreach ($eventId in $criticalEvents) {

    $events = Get-WinEvent -FilterHashtable @{

        LogName = 'System','Security','Application'

        ID = $eventId

    } -MaxEvents 10 -ErrorAction SilentlyContinue

    

    if ($events) {

        Write-Host "Event ID $eventId found:" -ForegroundColor Yellow

        $events | Select-Object TimeCreated, LogName, Message | Format-Table -AutoSize

    }

}

<h2 id="microsoft-security-providers">Microsoft Security providers</h2>

Get-WinEvent -FilterHashtable @{

    ProviderName = 'Microsoft-Windows-Security-Auditing'

} -MaxEvents 20



<h2 id="system-providers">System providers</h2>

Get-WinEvent -FilterHashtable @{

    ProviderName = 'Microsoft-Windows-Kernel-General','Microsoft-Windows-Kernel-Power'

} -MaxEvents 20



<h2 id="application-providers">Application providers</h2>

Get-WinEvent -FilterHashtable @{

    ProviderName = 'Application Error','Application Hang'

} -MaxEvents 20

<h2 id="nayti-vhod-polzovatelya">Найти вход пользователя</h2>

$loginEvent = Get-WinEvent -FilterHashtable @{

    LogName = 'Security'

    ID = 4624

    StartTime = (Get-Date).AddHours(-1)

} | Select-Object -First 1



if ($loginEvent) {

    $userSid = $loginEvent.Properties[4].Value

    $loginTime = $loginEvent.TimeCreated

    

    # Найти действия после входа

    $postLoginEvents = Get-WinEvent -FilterHashtable @{

        LogName = 'Security'

        StartTime = $loginTime

        EndTime = $loginTime.AddMinutes(30)

    } | Where-Object {

        $_.ID -in @(4688, 4663, 4656, 4658, 4660)  # Process creation, file access

    }

    

    Write-Host "Post-login activities for $($loginEvent.Properties[5].Value):"

    $postLoginEvents | Select-Object TimeCreated, ID, @{Name='Action';Expression={

        switch ($_.ID) {

            4688 {'Process Created'}

            4663 {'File Access'}

            4656 {'Handle Opened'}

            4658 {'Handle Closed'}

            4660 {'Object Deleted'}

        }

    }}

}

<h2 id="nayti-sistemnye-oshibki">Найти системные ошибки</h2>

$systemErrors = Get-WinEvent -FilterHashtable @{

    LogName = 'System'

    Level = 2  # Error

    StartTime = (Get-Date).AddDays(-1)

} | Select-Object TimeCreated, ID, Message



<h2 id="nayti-svyazannye-oshibki-prilozheniy">Найти связанные ошибки приложений</h2>

foreach ($error in $systemErrors) {

    $appErrors = Get-WinEvent -FilterHashtable @{

        LogName = 'Application'

        Level = 2

        StartTime = $error.TimeCreated.AddMinutes(-5)

        EndTime = $error.TimeCreated.AddMinutes(5)

    }

    

    if ($appErrors) {

        Write-Host "System error at $($error.TimeCreated):" -ForegroundColor Red

        Write-Host "Related application errors:" -ForegroundColor Yellow

        $appErrors | Select-Object TimeCreated, ProviderName, Message | Format-Table -AutoSize

    }

}

<h2 id="statistika-sobytiy-za-nedelyu">Статистика событий за неделю</h2>

$weekAgo = (Get-Date).AddDays(-7)

$events = Get-WinEvent -FilterHashtable @{

    LogName = 'Security'

    StartTime = $weekAgo

}



<h2 id="gruppirovka-po-event-id">Группировка по Event ID</h2>

$eventStats = $events | Group-Object ID | Select-Object Name, Count | Sort-Object Count -Descending



<h2 id="srednee-kolichestvo-v-den">Среднее количество в день</h2>

$dailyAverage = $events.Count / 7



Write-Host "Daily average events: $dailyAverage"

Write-Host "Top Event IDs:"

$eventStats | Select-Object -First 10 | Format-Table -AutoSize

<h2 id="tekuschaya-aktivnost">Текущая активность</h2>

$currentEvents = Get-WinEvent -FilterHashtable @{

    LogName = 'Security'

    StartTime = (Get-Date).AddHours(-1)

}



$currentStats = $currentEvents | Group-Object ID | Select-Object Name, Count



<h2 id="sravnenie-s-baseline">Сравнение с baseline</h2>

$anomalies = @()

foreach ($current in $currentStats) {

    $baseline = $eventStats | Where-Object { $_.Name -eq $current.Name }

    if ($baseline -and ($current.Count / $baseline.Count) > 3) {

        $anomalies += @{

            EventID = $current.Name

            CurrentCount = $current.Count

            BaselineCount = $baseline.Count

            Ratio = $current.Count / $baseline.Count

        }

    }

}



if ($anomalies) {

    Write-Host "Detected anomalies:" -ForegroundColor Red

    $anomalies | Format-Table -AutoSize

}

Get-WinEvent -FilterHashtable @{

    LogName = 'Security'

    ID = 4624,4625

    StartTime = (Get-Date).AddDays(-1)

} | Select-Object TimeCreated, ID, 

    @{Name='Username';Expression={$_.Properties[5].Value}},

    @{Name='Domain';Expression={$_.Properties[6].Value}},

    @{Name='LogonType';Expression={$_.Properties[8].Value}},

    @{Name='IP';Expression={$_.Properties[18].Value}} |

Export-Csv -Path 'login_events.csv' -NoTypeInformation

Get-WinEvent -FilterHashtable @{

    LogName = 'Security'

    ID = 4624

    StartTime = (Get-Date).AddHours(-24)

} | Export-Clixml -Path 'detailed_login_events.xml'

$events = Get-WinEvent -FilterHashtable @{

    LogName = 'System'

    Level = 1,2,3

    StartTime = (Get-Date).AddDays(-1)

}



$report = @"

<!DOCTYPE html>

<html>

<head>

    <title>Windows Event Logs Report</title>

    <style>

        body { font-family: Arial, sans-serif; }

        table { border-collapse: collapse; width: 100%; }

        th, td { border: 1px solid #ddd; padding: 8px; text-align: left; }

        th { background-color: #f2f2f2; }

        .error { color: red; }

        .warning { color: orange; }

        .info { color: blue; }

    </style>

</head>

<body>

    <h1>Windows Event Logs Analysis Report</h1>

    <p>Generated on: $(Get-Date)</p>

    <p>Period: Last 24 hours</p>

    

    <table>

        <thead>

            <tr>

                <th>Time</th>

                <th>Level</th>

                <th>ID</th>

                <th>Source</th>

                <th>Message</th>

            </tr>

        </thead>

        <tbody>

"@



foreach ($event in $events) {

    $levelClass = switch ($event.Level) {

        1 { 'error' }

        2 { 'error' }

        3 { 'warning' }

        4 { 'info' }

        default { '' }

    }

    

    $report += @"

            <tr class='$levelClass'>

                <td>$($event.TimeCreated)</td>

                <td>$($event.LevelDisplayName)</td>

                <td>$($event.ID)</td>

                <td>$($event.ProviderName)</td>

                <td>$($event.Message)</td>

            </tr>

"@

}



$report += @"

        </tbody>

    </table>

</body>

</html>

"@



$report | Out-File -FilePath 'event_logs_report.html' -Encoding UTF8

<EventData>

  <Data Name="SubjectUserSid">S-1-5-18</Data>

  <Data Name="SubjectUserName">WORKSTATION01$</Data>

  <Data Name="SubjectDomainName">WORKGROUP</Data>

  <Data Name="PrivilegeList">SeTcbPrivilege</Data>

</EventData>

<EventData>

  <Data Name="SubjectUserSid">S-1-5-18</Data>

  <Data Name="SubjectUserName">WORKSTATION01$</Data>

  <Data Name="SubjectDomainName">WORKGROUP</Data>

  <Data Name="PrivilegeList">SeTcbPrivilege</Data>

</EventData>

<EventData>

  <Data Name="SubjectUserSid">S-1-5-21-...-1001</Data>

  <Data Name="SubjectUserName">Administrator</Data>

  <Data Name="SubjectDomainName">WORKSTATION01</Data>

  <Data Name="CategoryId">%%8272</Data>

  <Data Name="SubcategoryId">%%12593</Data>

  <Data Name="SubcategoryGuid">{0CCE9226-69AE-11D9-BED3-505054503030}</Data>

  <Data Name="AuditPolicyChanges">%%8448</Data>

</EventData>

<EventData>

  <Data Name="SubjectUserSid">S-1-5-21-...-1001</Data>

  <Data Name="SubjectUserName">Administrator</Data>

  <Data Name="SubjectDomainName">WORKSTATION01</Data>

  <Data Name="ObjectServer">Security</Data>

  <Data Name="ObjectType">File</Data>

  <Data Name="ObjectName">C:\Windows\System32\config\SAM</Data>

  <Data Name="HandleId">0x8c8</Data>

  <Data Name="OldSd">D:(A;;FA;;;BA)(A;;FA;;;SY)</Data>

  <Data Name="NewSd">D:(A;;FA;;;BA)(A;;FA;;;SY)(A;;FR;;;BU)</Data>

  <Data Name="ProcessId">0x4f4</Data>

  <Data Name="ProcessName">C:\Windows\System32\mmc.exe</Data>

</EventData>

<EventData>

  <Data Name="SubjectUserSid">S-1-5-21-...-1001</Data>

  <Data Name="SubjectUserName">user1</Data>

  <Data Name="SubjectDomainName">WORKSTATION01</Data>

  <Data Name="SubjectLogonId">0x1a4d5</Data>

  <Data Name="NewProcessId">0x4f4</Data>

  <Data Name="NewProcessName">C:\Windows\System32\notepad.exe</Data>

  <Data Name="TokenElevationType">%%1936</Data>

  <Data Name="ProcessId">0x3c8</Data>

  <Data Name="CommandLine">notepad.exe C:\temp\file.txt</Data>

  <Data Name="TargetUserSid">S-1-5-21-...-1001</Data>

  <Data Name="TargetUserName">user1</Data>

  <Data Name="TargetDomainName">WORKSTATION01</Data>

  <Data Name="TargetLogonId">0x1a4d5</Data>

  <Data Name="ParentProcessName">C:\Windows\explorer.exe</Data>

</EventData>

<h2 id="monitoring-kriticheskih-sobytiy">Мониторинг критических событий</h2>

$criticalEvents = 4608, 4609, 4719, 4670, 4688



foreach ($eventId in $criticalEvents) {

    $action = {

        param($event)

        Write-Host "Critical event $eventId detected:" -ForegroundColor Red

        Write-Host "Time: $($event.TimeCreated)"

        Write-Host "Message: $($event.Message)"

        

        # Отправка оповещения

        # Send-MailMessage -To admin@company.com -Subject "Critical Security Event" -Body $event.Message

    }

    

    Register-WmiEvent -Query "SELECT * FROM Win32_NTLogEvent WHERE EventCode = $eventId" -Action $action

}

<h2 id="proverka-nalichiya-kriticheskih-sobytiy">Проверка наличия критических событий</h2>

$auditQuery = @"

SELECT COUNT(*) as EventCount, EventID

FROM Win32_NTLogEvent 

WHERE EventCode IN (4608, 4609, 4719, 4670, 4688)

  AND TimeGenerated > '$((Get-Date).AddDays(-7).ToString('yyyyMMddHHmmss.ffffff+000'))'

GROUP BY EventID

"@



Get-WmiObject -Query $auditQuery | Format-Table -AutoSize

<EventData>

  <Data Name="SubjectUserSid">S-1-5-18</Data>

  <Data Name="SubjectUserName">WORKSTATION01$</Data>

  <Data Name="SubjectDomainName">WORKGROUP</Data>

  <Data Name="SubjectLogonId">0x3e7</Data>

  <Data Name="TargetUserSid">S-1-5-21-...-1001</Data>

  <Data Name="TargetUserName">Administrator</Data>

  <Data Name="TargetDomainName">WORKSTATION01</Data>

  <Data Name="TargetLogonId">0x8dcdc</Data>

  <Data Name="LogonType">2</Data>

  <Data Name="LogonProcessName">User32</Data>

  <Data Name="AuthenticationPackageName">Negotiate</Data>

  <Data Name="WorkstationName">WORKSTATION01</Data>

  <Data Name="LogonGuid">{00000000-0000-0000-0000-000000000000}</Data>

  <Data Name="TransmittedServices">-</Data>

  <Data Name="LmPackageName">-</Data>

  <Data Name="KeyLength">0</Data>

  <Data Name="ProcessId">0x1a4</Data>

  <Data Name="ProcessName">C:\Windows\System32\winlogon.exe</Data>

  <Data Name="IpAddress">-</Data>

  <Data Name="IpPort">-</Data>

</EventData>

<h2 id="analiz-uspeshnyh-vhodov-za-posledniy-den">Анализ успешных входов за последний день</h2>

$successfulLogons = Get-WinEvent -FilterHashtable @{

    LogName = 'Security'

    ID = 4624

    StartTime = (Get-Date).AddDays(-1)

} | Select-Object TimeCreated, 

    @{Name='Username';Expression={$_.Properties[5].Value}},

    @{Name='Domain';Expression={$_.Properties[6].Value}},

    @{Name='LogonType';Expression={$_.Properties[8].Value}},

    @{Name='Workstation';Expression={$_.Properties[11].Value}},

    @{Name='IP';Expression={$_.Properties[18].Value}}



<h2 id="statistika-po-tipam-vhoda">Статистика по типам входа</h2>

$logonStats = $successfulLogons | Group-Object LogonType | Select-Object Name, Count | Sort-Object Count -Descending



<h2 id="poisk-podozritelnyh-vhodov">Поиск подозрительных входов</h2>

$suspiciousLogons = $successfulLogons | Where-Object {

    $_.LogonType -eq 3 -and $_.IP -notmatch '^192\.168\.|^10\.|^172\.(1[6-9]|2[0-9]|3[0-1])\.'  # External network logons

}



Write-Host "Successful logons statistics:"

$logonStats | Format-Table -AutoSize



Write-Host "Suspicious network logons:"

$suspiciousLogons | Format-Table -AutoSize

<EventData>

  <Data Name="SubjectUserSid">S-1-5-18</Data>

  <Data Name="SubjectUserName">-</Data>

  <Data Name="SubjectDomainName">-</Data>

  <Data Name="SubjectLogonId">0x0</Data>

  <Data Name="TargetUserSid">S-1-5-21-...-1001</Data>

  <Data Name="TargetUserName">Administrator</Data>

  <Data Name="TargetDomainName">WORKSTATION01</Data>

  <Data Name="Status">0xc000006a</Data>

  <Data Name="FailureReason">%%2313</Data>

  <Data Name="SubStatus">0xc000006a</Data>

  <Data Name="LogonType">2</Data>

  <Data Name="LogonProcessName">User32</Data>

  <Data Name="AuthenticationPackageName">Negotiate</Data>

  <Data Name="WorkstationName">WORKSTATION01</Data>

  <Data Name="TransmittedServices">-</Data>

  <Data Name="LmPackageName">-</Data>

  <Data Name="KeyLength">0</Data>

  <Data Name="ProcessId">0x1a4</Data>

  <Data Name="ProcessName">C:\Windows\System32\winlogon.exe</Data>

  <Data Name="IpAddress">-</Data>

  <Data Name="IpPort">-</Data>

</EventData>

<h2 id="analiz-neudachnyh-vhodov">Анализ неудачных входов</h2>

$failedLogons = Get-WinEvent -FilterHashtable @{

    LogName = 'Security'

    ID = 4625

    StartTime = (Get-Date).AddHours(-24)

} | Select-Object TimeCreated,

    @{Name='Username';Expression={$_.Properties[5].Value}},

    @{Name='Domain';Expression={$_.Properties[6].Value}},

    @{Name='FailureReason';Expression={$_.Properties[7].Value}},

    @{Name='Status';Expression={$_.Properties[9].Value}},

    @{Name='Workstation';Expression={$_.Properties[13].Value}},

    @{Name='IP';Expression={$_.Properties[19].Value}}



<h2 id="gruppirovka-po-prichinam-neudach">Группировка по причинам неудач</h2>

$failureStats = $failedLogons | Group-Object FailureReason | Select-Object Name, Count | Sort-Object Count -Descending



<h2 id="poisk-brute-force-atak">Поиск brute force атак</h2>

$bruteForceCandidates = $failedLogons | Group-Object Username, IP | Where-Object { $_.Count -gt 5 } | Select-Object Name, Count



<h2 id="analiz-po-vremeni-poisk-automated-attacks">Анализ по времени (поиск automated attacks)</h2>

$hourlyFailed = $failedLogons | Group-Object { $_.TimeCreated.Hour } | Select-Object Name, Count | Sort-Object Name



Write-Host "Failed logon statistics:"

$failureStats | Format-Table -AutoSize



Write-Host "Potential brute force attacks:"

$bruteForceCandidates | Select-Object -First 10 | Format-Table -AutoSize

<EventData>

  <Data Name="SubjectUserSid">S-1-5-21-...-1001</Data>

  <Data Name="SubjectUserName">Administrator</Data>

  <Data Name="SubjectDomainName">WORKSTATION01</Data>

  <Data Name="SubjectLogonId">0x8dcdc</Data>

  <Data Name="PrivilegeList">SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege</Data>

</EventData>

<h2 id="monitoring-kriticheskih-sobytiy-autentifikatsii">Мониторинг критических событий аутентификации</h2>

$authEvents = @(

    4624,  # Successful logon

    4625,  # Failed logon  

    4634,  # Logoff

    4648,  # Explicit credential logon

    4672,  # Special privileges assigned

    4771   # Kerberos pre-auth failed

)



<h2 id="sozdanie-filtra-dlya-monitoringa">Создание фильтра для мониторинга</h2>

$query = @"

<QueryList>

  <Query Id="0" Path="Security">

    <Select Path="Security">

      *[System[(EventID=4624 or EventID=4625 or EventID=4634 or EventID=4648 or EventID=4672 or EventID=4771)]]

    </Select>

  </Query>

</QueryList>

"@



<h2 id="sohranenie-xml-filtra">Сохранение XML фильтра</h2>

$query | Out-File -FilePath 'auth_monitor.xml' -Encoding UTF8



<h2 id="sozdanie-podpiski-na-sobytiya">Создание подписки на события</h2>

Register-WmiEvent -Query "SELECT * FROM Win32_NTLogEvent WHERE Logfile='Security' AND (EventCode=4624 OR EventCode=4625 OR EventCode=4634 OR EventCode=4648 OR EventCode=4672 OR EventCode=4771)" -Action {

    param($event)

    

    $eventData = $event.InsertionStrings

    

    switch ($event.EventCode) {

        4624 { 

            $message = "Successful logon: $($eventData[5]) from $($eventData[11])"

            # Send success notification

        }

        4625 {

            $message = "Failed logon attempt: $($eventData[5]) from $($eventData[13])"

            # Send alert for failed logon

        }

        4672 {

            $message = "Special privileges assigned to: $($eventData[1])"

            # Send high-priority alert

        }

    }

    

    Write-Host "$(Get-Date): $message" -ForegroundColor Yellow

}

<h2 id="poisk-patternov-brute-force">Поиск паттернов brute force</h2>

$failedAttempts = Get-WinEvent -FilterHashtable @{

    LogName = 'Security'

    ID = 4625

    StartTime = (Get-Date).AddHours(-1)

}



<h2 id="gruppirovka-po-ip-i-vremeni">Группировка по IP и времени</h2>

$attackPatterns = $failedAttempts | Group-Object {

    $ip = $_.Properties[19].Value

    $minute = $_.TimeCreated.ToString('yyyy-MM-dd HH:mm')

    "$ip|$minute"

} | Where-Object { $_.Count -gt 3 } | Select-Object Name, Count



if ($attackPatterns) {

    Write-Host "Potential brute force attacks detected:" -ForegroundColor Red

    foreach ($pattern in $attackPatterns) {

        $ip, $minute = $pattern.Name -split '\|'

        Write-Host "IP: $ip, Time: $minute, Attempts: $($pattern.Count)"

    }

}

<EventData>

  <Data Name="param1">application.exe</Data>

  <Data Name="param2">1.0.0.0</Data>

  <Data Name="param3">12345678</Data>

  <Data Name="param4">kernel32.dll</Data>

  <Data Name="param5">10.0.19041.1889</Data>

  <Data Name="param6">abcdef12</Data>

  <Data Name="param7">c0000005</Data>

  <Data Name="param8">0000abcd</Data>

  <Data Name="param9">C:\temp\error.dmp</Data>

  <Data Name="param10">01234567-89ab-cdef-0123-456789abcdef</Data>

</EventData>

<h2 id="analiz-sboev-prilozheniy">Анализ сбоев приложений</h2>

$appCrashes = Get-WinEvent -FilterHashtable @{

    LogName = 'Application'

    ID = 1000

    StartTime = (Get-Date).AddDays(-7)

} | Select-Object TimeCreated,

    @{Name='Application';Expression={$_.Properties[0].Value}},

    @{Name='Version';Expression={$_.Properties[1].Value}},

    @{Name='Module';Expression={$_.Properties[3].Value}},

    @{Name='ErrorCode';Expression={$_.Properties[6].Value}}



<h2 id="gruppirovka-po-prilozheniyam">Группировка по приложениям</h2>

$appCrashStats = $appCrashes | Group-Object Application | Select-Object Name, Count | Sort-Object Count -Descending



<h2 id="poisk-chasto-padayuschih-prilozheniy">Поиск часто падающих приложений</h2>

$frequentCrashers = $appCrashStats | Where-Object { $_.Count -gt 5 }



Write-Host "Top crashing applications:"

$appCrashStats | Select-Object -First 10 | Format-Table -AutoSize



if ($frequentCrashers) {

    Write-Host "Applications with frequent crashes (>5 times):" -ForegroundColor Red

    $frequentCrashers | Format-Table -AutoSize

}

<EventData>

  <Data Name="param1">C:\Windows\System32\shutdown.exe</Data>

  <Data Name="param2">WORKSTATION01</Data>

  <Data Name="param3">0x80020002</Data>

  <Data Name="param4">0x5000000</Data>

  <Data Name="param5">restart</Data>

  <Data Name="param6">0x80020002</Data>

  <Data Name="param7">User32</Data>

  <Data Name="param8">restart</Data>

  <Data Name="param9">User32</Data>

  <Data Name="param10">restart</Data>

</EventData>

<h2 id="sbor-vseh-sistemnyh-oshibok">Сбор всех системных ошибок</h2>

$systemErrors = Get-WinEvent -FilterHashtable @{

    LogName = 'System'

    Level = 2,3  # Error, Warning

    StartTime = (Get-Date).AddDays(-30)

}



<h2 id="klassifikatsiya-oshibok-po-istochniku">Классификация ошибок по источнику</h2>

$errorBySource = $systemErrors | Group-Object ProviderName | Select-Object Name, Count | Sort-Object Count -Descending



<h2 id="analiz-trendov">Анализ трендов</h2>

$dailyErrors = $systemErrors | Group-Object { $_.TimeCreated.Date } | Select-Object Name, Count



<h2 id="poisk-kriticheskih-patternov">Поиск критических паттернов</h2>

$criticalPatterns = @(

    "*memory*",

    "*disk*",

    "*network*",

    "*driver*",

    "*service*"

)



$patternMatches = @()

foreach ($pattern in $criticalPatterns) {

    $matches = $systemErrors | Where-Object { $_.Message -like $pattern }

    if ($matches) {

        $patternMatches += @{

            Pattern = $pattern

            Count = $matches.Count

            LatestEvent = ($matches | Sort-Object TimeCreated -Descending | Select-Object -First 1).TimeCreated

        }

    }

}



<h2 id="sozdanie-svodnogo-otcheta">Создание сводного отчета</h2>

$report = @"

System Errors Analysis Report

Generated: $(Get-Date)



Total errors in last 30 days: $($systemErrors.Count)



Top error sources:

$($errorBySource | Select-Object -First 10 | Format-Table -AutoSize | Out-String)



Critical patterns found:

$($patternMatches | Format-Table -AutoSize | Out-String)



Daily error trends:

$($dailyErrors | Select-Object -First 10 | Format-Table -AutoSize | Out-String)

"@



$report | Out-File -FilePath 'system_errors_report.txt' -Encoding UTF8

Write-Host "System errors report generated: system_errors_report.txt"

<h2 id="opredelenie-kriticheskih-sobytiy">Определение критических событий</h2>

$criticalSystemEvents = @(

    1001,  # System crash

    1003,  # System error

    1005,  # Access failure

    1014,  # DNS timeout

    1074,  # System restart

    2019,  # Memory allocation failure

    2020   # Nonpaged pool depletion

)



<h2 id="sozdanie-monitoringa">Создание мониторинга</h2>

foreach ($eventId in $criticalSystemEvents) {

    Register-WmiEvent -Query "SELECT * FROM Win32_NTLogEvent WHERE Logfile='System' AND EventCode=$eventId" -Action {

        param($event)

        

        $alertMessage = @"

CRITICAL SYSTEM EVENT DETECTED!

Event ID: $($event.EventCode)

Time: $($event.TimeGenerated)

Source: $($event.SourceName)

Message: $($event.Message)

"@

        

        # Отправка оповещения

        Write-Host $alertMessage -ForegroundColor Red

        

        # Логирование в файл

        $logEntry = "$(Get-Date): CRITICAL EVENT $($event.EventCode) - $($event.Message)"

        Add-Content -Path 'critical_system_events.log' -Value $logEntry

    }

}

<h2 id="ezhenedelnyy-audit">Еженедельный аудит</h2>

function New-SystemHealthReport {

    param(

        [int]$DaysBack = 7

    )

    

    $startDate = (Get-Date).AddDays(-$DaysBack)

    

    # Сбор данных

    $systemErrors = Get-WinEvent -FilterHashtable @{

        LogName = 'System'

        Level = 2  # Errors only

        StartTime = $startDate

    }

    

    $applicationErrors = Get-WinEvent -FilterHashtable @{

        LogName = 'Application'

        Level = 2

        StartTime = $startDate

    }

    

    # Анализ паттернов

    $errorTrends = $systemErrors | Group-Object { $_.TimeCreated.Date } | Select-Object Name, Count

    $topErrorSources = $systemErrors | Group-Object ProviderName | Select-Object Name, Count | Sort-Object Count -Descending | Select-Object -First 5

    

    # Проверка на критические проблемы

    $criticalIssues = @()

    

    if (($systemErrors | Where-Object { $_.ID -eq 1001 }).Count -gt 0) {

        $criticalIssues += "System crashes detected"

    }

    

    if (($systemErrors | Where-Object { $_.Message -like "*memory*" }).Count -gt 5) {

        $criticalIssues += "Memory issues detected"

    }

    

    # Генерация отчета

    $healthReport = [PSCustomObject]@{

        ReportDate = Get-Date

        PeriodDays = $DaysBack

        SystemErrors = $systemErrors.Count

        ApplicationErrors = $applicationErrors.Count

        TopErrorSources = $topErrorSources

        CriticalIssues = $criticalIssues

        HealthStatus = if ($criticalIssues.Count -eq 0) { "Good" } else { "Needs Attention" }

    }

    

    return $healthReport

}



<h2 id="ispolzovanie">Использование</h2>

$healthReport = New-SystemHealthReport -DaysBack 30

$healthReport

<EventData>

  <Data Name="param1">Microsoft Office Professional Plus 2019</Data>

  <Data Name="param2">{90160000-008C-0000-0000-0000000FF1CE}</Data>

  <Data Name="param3">16.0.10325.20082</Data>

  <Data Name="param4">1</Data>

  <Data Name="param5">INSTALL</Data>

  <Data Name="param6">1</Data>

  <Data Name="param7">{00000000-0000-0000-0000-000000000000}</Data>

  <Data Name="param8">0</Data>

  <Data Name="param9">1</Data>

</EventData>

<h2 id="analiz-aktivnosti-windows-defender">Анализ активности Windows Defender</h2>

$defenderEvents = Get-WinEvent -FilterHashtable @{

    ProviderName = 'Microsoft-Windows-Windows Defender'

    StartTime = (Get-Date).AddDays(-7)

} | Select-Object TimeCreated, ID, LevelDisplayName,

    @{Name='Message';Expression={$_.Message -replace '\r?\n', ' '}}



<h2 id="statistika-obnaruzheniy">Статистика обнаружений</h2>

$detectionStats = $defenderEvents | Where-Object { $_.ID -eq 1006 } | Group-Object { $_.TimeCreated.Date } | Select-Object Name, Count



<h2 id="analiz-tipov-ugroz">Анализ типов угроз</h2>

$threatTypes = $defenderEvents | Where-Object { $_.ID -in 1006, 1008, 1015 } | Group-Object ID | Select-Object Name, Count



Write-Host "Windows Defender Activity (Last 7 days):"

Write-Host "Total events: $($defenderEvents.Count)"

Write-Host "Detections by day:"

$detectionStats | Format-Table -AutoSize



Write-Host "Threat actions:"

$threatTypes | Format-Table @{Name='Action';Expression={

    switch ($_.Name) {

        1006 { 'Detected' }

        1008 { 'Quarantined' }

        1015 { 'Removed' }

    }

}}, Count -AutoSize

<h2 id="analiz-oshibok-prilozheniy">Анализ ошибок приложений</h2>

$appErrors = Get-WinEvent -FilterHashtable @{

    LogName = 'Application'

    Level = 2,3  # Error, Warning

    StartTime = (Get-Date).AddDays(-14)

} | Select-Object TimeCreated, ProviderName, ID, LevelDisplayName,

    @{Name='ShortMessage';Expression={$_.Message.Substring(0, [Math]::Min(100, $_.Message.Length)) + '...' }}



<h2 id="gruppirovka-po-prilozheniyam">Группировка по приложениям</h2>

$appErrorStats = $appErrors | Group-Object ProviderName | Select-Object Name, Count | Sort-Object Count -Descending



<h2 id="poisk-chasto-padayuschih-prilozheniy">Поиск часто падающих приложений</h2>

$frequentErrors = $appErrorStats | Where-Object { $_.Count -gt 10 }



<h2 id="analiz-po-dnyam">Анализ по дням</h2>

$dailyAppErrors = $appErrors | Group-Object { $_.TimeCreated.Date } | Select-Object Name, Count



Write-Host "Application Error Analysis (Last 14 days):"

Write-Host "Total errors: $($appErrors.Count)"

Write-Host "Top error sources:"

$appErrorStats | Select-Object -First 10 | Format-Table -AutoSize



if ($frequentErrors) {

    Write-Host "Applications with frequent errors (>10):" -ForegroundColor Red

    $frequentErrors | Format-Table -AutoSize

}

<h2 id="monitoring-sluzhb">Мониторинг служб</h2>

$serviceEvents = Get-WinEvent -FilterHashtable @{

    LogName = 'System'

    ProviderName = 'Service Control Manager'

    StartTime = (Get-Date).AddDays(-7)

}



<h2 id="analiz-sboev-sluzhb">Анализ сбоев служб</h2>

$serviceFailures = $serviceEvents | Where-Object { $_.ID -in 7000, 7009, 7011, 7016, 7022, 7023, 7024 }



<h2 id="gruppirovka-po-sluzhbam">Группировка по службам</h2>

$failedServices = $serviceFailures | Group-Object {

    # Извлечение имени службы из сообщения

    if ($_.Message -match 'service\s+([^(\s]+)') {

        $matches[1]

    } else {

        'Unknown'

    }

} | Select-Object Name, Count | Sort-Object Count -Descending



Write-Host "Service Failure Analysis (Last 7 days):"

Write-Host "Total service events: $($serviceEvents.Count)"

Write-Host "Service failures: $($serviceFailures.Count)"



if ($failedServices) {

    Write-Host "Most failed services:"

    $failedServices | Select-Object -First 5 | Format-Table -AutoSize

}

<h2 id="registratsiya-polzovatelskogo-sobytiya">Регистрация пользовательского события</h2>

Write-EventLog -LogName 'Application' -Source 'MyApp' -EventID 10001 -EntryType Information -Message 'Custom application event'



<h2 id="sozdanie-polzovatelskogo-istochnika">Создание пользовательского источника</h2>

New-EventLog -LogName 'MyCustomLog' -Source 'MyApp'



<h2 id="zapis-v-polzovatelskiy-zhurnal">Запись в пользовательский журнал</h2>

Write-EventLog -LogName 'MyCustomLog' -Source 'MyApp' -EventID 1 -EntryType Information -Message 'Test event'

<h2 id="prosmotr-polzovatelskih-zhurnalov">Просмотр пользовательских журналов</h2>

Get-WinEvent -ListLog * | Where-Object { $_.LogName -notmatch '^(System|Application|Security)$' } | Select-Object LogName, RecordCount



<h2 id="analiz-konkretnogo-polzovatelskogo-zhurnala">Анализ конкретного пользовательского журнала</h2>

Get-WinEvent -LogName 'MyCustomLog' -MaxEvents 10 | Format-Table TimeCreated, ID, Message -AutoSize

<h2 id="poisk-svyazannyh-sobytiy">Поиск связанных событий</h2>

$appEvent = Get-WinEvent -FilterHashtable @{

    LogName = 'Application'

    ID = 1000  # Application crash

} | Select-Object -First 1



if ($appEvent) {

    # Поиск системных событий в то же время

    $relatedSystemEvents = Get-WinEvent -FilterHashtable @{

        LogName = 'System'

        StartTime = $appEvent.TimeCreated.AddMinutes(-5)

        EndTime = $appEvent.TimeCreated.AddMinutes(5)

    } | Where-Object { $_.Level -le 3 } # Errors and warnings



    Write-Host "Application crash at $($appEvent.TimeCreated):"

    Write-Host "Related system events:"

    $relatedSystemEvents | Select-Object TimeCreated, ProviderName, ID, LevelDisplayName | Format-Table -AutoSize

}

<h2 id="analiz-sobytiy-proizvoditelnosti">Анализ событий производительности</h2>

$perfEvents = Get-WinEvent -FilterHashtable @{

    ProviderName = 'Microsoft-Windows-Resource-Exhaustion-Detector'

    StartTime = (Get-Date).AddDays(-1)

}



if ($perfEvents) {

    Write-Host "Performance issues detected:"

    $perfEvents | Select-Object TimeCreated, ID, Message | Format-Table -AutoSize

}

<h2 id="funktsiya-dlya-korrelyatsii-sobytiy-po-vremeni">Функция для корреляции событий по времени</h2>

function Get-CorrelatedEvents {

    param(

        [DateTime]$StartTime,

        [DateTime]$EndTime,

        [int]$TimeWindowMinutes = 5

    )

    

    # Получение событий из разных журналов

    $securityEvents = Get-WinEvent -FilterHashtable @{

        LogName = 'Security'

        StartTime = $StartTime

        EndTime = $EndTime

    }

    

    $systemEvents = Get-WinEvent -FilterHashtable @{

        LogName = 'System'

        StartTime = $StartTime

        EndTime = $EndTime

    }

    

    $appEvents = Get-WinEvent -FilterHashtable @{

        LogName = 'Application'

        StartTime = $StartTime

        EndTime = $EndTime

    }

    

    # Корреляция по времени

    $correlatedEvents = @()

    

    foreach ($secEvent in $securityEvents) {

        $eventTime = $secEvent.TimeCreated

        $timeWindowStart = $eventTime.AddMinutes(-$TimeWindowMinutes)

        $timeWindowEnd = $eventTime.AddMinutes($TimeWindowMinutes)

        

        # Поиск связанных событий

        $relatedSystem = $systemEvents | Where-Object {

            $_.TimeCreated -ge $timeWindowStart -and $_.TimeCreated -le $timeWindowEnd

        }

        

        $relatedApp = $appEvents | Where-Object {

            $_.TimeCreated -ge $timeWindowStart -and $_.TimeCreated -le $timeWindowEnd

        }

        

        if ($relatedSystem -or $relatedApp) {

            $correlatedEvents += [PSCustomObject]@{

                SecurityEvent = $secEvent

                RelatedSystemEvents = $relatedSystem

                RelatedAppEvents = $relatedApp

                CorrelationTime = $eventTime

            }

        }

    }

    

    return $correlatedEvents

}



<h2 id="ispolzovanie">Использование</h2>

$correlations = Get-CorrelatedEvents -StartTime (Get-Date).AddHours(-1) -EndTime (Get-Date)

$correlations | Select-Object CorrelationTime, @{Name='SecurityID';Expression={$_.SecurityEvent.ID}}, @{Name='SystemCount';Expression={$_.RelatedSystemEvents.Count}}, @{Name='AppCount';Expression={$_.RelatedAppEvents.Count}}

import pandas as pd

from datetime import datetime, timedelta

import matplotlib.pyplot as plt



def create_event_timeline(hours_back=24):

    """

    Создание timeline всех критических событий

    """

    # Получение событий через PowerShell

    import subprocess

    

    ps_command = f'''

    $events = Get-WinEvent -FilterHashtable @{{

        LogName = 'Security','System','Application'

        Level = 1,2,3

        StartTime = (Get-Date).AddHours(-{hours_back})

    }} | Select-Object TimeCreated, LogName, ID, LevelDisplayName, ProviderName

    

    $events | ConvertTo-Json

    '''

    

    result = subprocess.run(['powershell', '-Command', ps_command], 

                          capture_output=True, text=True)

    

    if result.returncode == 0:

        import json

        events_data = json.loads(result.stdout)

        

        # Создание DataFrame

        df = pd.DataFrame(events_data)

        df['TimeCreated'] = pd.to_datetime(df['TimeCreated'])

        df.set_index('TimeCreated', inplace=True)

        

        # Анализ по часам

        hourly_stats = df.resample('H').size()

        

        # Визуализация

        plt.figure(figsize=(12, 6))

        hourly_stats.plot(kind='line', marker='o')

        plt.title(f'Event Timeline (Last {hours_back} hours)')

        plt.xlabel('Time')

        plt.ylabel('Number of Events')

        plt.grid(True)

        plt.xticks(rotation=45)

        plt.tight_layout()

        plt.savefig('event_timeline.png')

        plt.show()

        

        # Статистика по типам событий

        event_types = df.groupby(['LogName', 'LevelDisplayName']).size().unstack().fillna(0)

        

        return {

            'timeline_data': hourly_stats,

            'event_types': event_types,

            'total_events': len(df)

        }

    

    return None



<h2 id="ispolzovanie">Использование</h2>

timeline_analysis = create_event_timeline(hours_back=48)

if timeline_analysis:

    print(f"Total events analyzed: {timeline_analysis['total_events']}")

    print("Event types distribution:")

    print(timeline_analysis['event_types'])

def detect_anomalies(events_df, window_days=7):

    """

    Выявление аномалий в событиях

    """

    # Расчет скользящего среднего

    daily_counts = events_df.resample('D').size()

    rolling_mean = daily_counts.rolling(window=window_days).mean()

    rolling_std = daily_counts.rolling(window=window_days).std()

    

    # Выявление аномалий (более 2 стандартных отклонений)

    anomalies = daily_counts[

        (daily_counts - rolling_mean) > 2 * rolling_std

    ]

    

    return {

        'daily_counts': daily_counts,

        'anomalies': anomalies,

        'rolling_mean': rolling_mean,

        'threshold': rolling_mean + 2 * rolling_std

    }



<h2 id="analiz-anomaliy-vhoda">Анализ аномалий входа</h2>

login_events = events_df[events_df['ID'] == 4624]

login_anomalies = detect_anomalies(login_events)



if not login_anomalies['anomalies'].empty:

    print("Login anomalies detected:")

    for date, count in login_anomalies['anomalies'].items():

        print(f"{date.date()}: {count} logins (threshold: {login_anomalies['threshold'][date]:.1f})")

from statsmodels.tsa.arima.model import ARIMA

import numpy as np



def forecast_events(events_df, forecast_days=7):

    """

    Прогнозирование количества событий

    """

    # Подготовка данных

    daily_counts = events_df.resample('D').size()

    

    # ARIMA модель

    model = ARIMA(daily_counts, order=(1, 1, 1))

    model_fit = model.fit()

    

    # Прогноз

    forecast = model_fit.forecast(steps=forecast_days)

    

    # Вероятность превышения порогов

    mean_forecast = forecast.mean()

    std_forecast = forecast.std()

    

    # Порог аномалии (95-й перцентиль исторических данных)

    threshold = daily_counts.quantile(0.95)

    

    # Вероятность превышения порога

    prob_exceed = 1 - norm.cdf(threshold, mean_forecast, std_forecast)

    

    return {

        'forecast': forecast,

        'threshold': threshold,

        'prob_exceed_threshold': prob_exceed,

        'recommended_capacity': mean_forecast + 2 * std_forecast

    }



<h2 id="prognozirovanie-sistemnyh-oshibok">Прогнозирование системных ошибок</h2>

error_events = events_df[events_df['Level'] <= 2]  # Errors and critical

forecast_result = forecast_events(error_events, forecast_days=30)



print(f"Forecasted daily errors: {forecast_result['forecast'].mean():.1f}")

print(f"Probability of exceeding threshold: {forecast_result['prob_exceed_threshold']:.3%}")

print(f"Recommended monitoring capacity: {forecast_result['recommended_capacity']:.1f}")

def correlate_with_threat_intel(events_df, threat_indicators):

    """

    Корреляция с threat intelligence

    """

    matches = []

    

    for _, event in events_df.iterrows():

        # Проверка IP адресов

        if 'ClientIP' in event and event['ClientIP'] in threat_indicators['malicious_ips']:

            matches.append({

                'event': event,

                'match_type': 'malicious_ip',

                'indicator': event['ClientIP'],

                'threat_level': 'high'

            })

        

        # Проверка доменов

        if 'Domain' in event and event['Domain'] in threat_indicators['malicious_domains']:

            matches.append({

                'event': event,

                'match_type': 'malicious_domain',

                'indicator': event['Domain'],

                'threat_level': 'high'

            })

        

        # Проверка хешей файлов

        if 'FileHash' in event and event['FileHash'] in threat_indicators['malware_hashes']:

            matches.append({

                'event': event,

                'match_type': 'malware_hash',

                'indicator': event['FileHash'],

                'threat_level': 'critical'

            })

    

    return matches



<h2 id="primer-ispolzovaniya">Пример использования</h2>

threat_indicators = {

    'malicious_ips': ['192.168.1.100', '10.0.0.5'],

    'malicious_domains': ['malicious-site.com', 'phishing-domain.ru'],

    'malware_hashes': ['a1b2c3d4e5f6...', '1234567890abcdef...']

}



threat_matches = correlate_with_threat_intel(events_df, threat_indicators)



if threat_matches:

    print(f"Found {len(threat_matches)} threat intelligence matches:")

    for match in threat_matches:

        print(f"- {match['match_type']}: {match['indicator']} (level: {match['threat_level']})")

<!-- Пример XPath для сложного поиска -->

<QueryList>

  <Query Id="0" Path="Security">

    <Select Path="Security">

      *[System[TimeCreated[@SystemTime >= '2024-01-01T00:00:00' and @SystemTime <= '2024-12-31T23:59:59']]]

      and

      *[EventData[Data[@Name='LogonType'] = '3']]

      and

      *[EventData[Data[@Name='IpAddress'] != '-']]

    </Select>

  </Query>

</QueryList>

<h2 id="sozdanie-slozhnogo-filtra">Создание сложного фильтра</h2>

$xpathQuery = @"

<QueryList>

  <Query Id="0" Path="Security">

    <Select Path="Security">

      *[System[EventID=4624]]

      and

      *[EventData[Data[@Name='LogonType']='10']]

      and

      *[EventData[Data[@Name='IpAddress']!='-']]

    </Select>

  </Query>

</QueryList>

"@



<h2 id="vypolnenie-zaprosa">Выполнение запроса</h2>

$rdpLogons = Get-WinEvent -FilterXml $xpathQuery -MaxEvents 20



Write-Host "RDP logons found:"

$rdpLogons | Select-Object TimeCreated, @{Name='Username';Expression={$_.Properties[5].Value}}, @{Name='IP';Expression={$_.Properties[18].Value}} | Format-Table -AutoSize

from sklearn.cluster import DBSCAN

from sklearn.preprocessing import StandardScaler



def cluster_events(events_df):

    """

    Кластеризация событий для выявления паттернов

    """

    # Подготовка данных

    features = events_df[['Hour', 'DayOfWeek', 'EventID']].copy()

    features['Hour'] = features['TimeCreated'].dt.hour

    features['DayOfWeek'] = features['TimeCreated'].dt.dayofweek

    

    # Масштабирование

    scaler = StandardScaler()

    scaled_features = scaler.fit_transform(features[['Hour', 'DayOfWeek']])

    

    # DBSCAN кластеризация

    dbscan = DBSCAN(eps=0.5, min_samples=5)

    clusters = dbscan.fit_predict(scaled_features)

    

    events_df['cluster'] = clusters

    

    # Анализ кластеров

    cluster_stats = events_df.groupby('cluster').agg({

        'EventID': 'count',

        'Hour': 'mean',

        'DayOfWeek': 'mean'

    }).rename(columns={'EventID': 'count'})

    

    return {

        'clustered_events': events_df,

        'cluster_stats': cluster_stats,

        'noise_points': (clusters == -1).sum()

    }



<h2 id="klasterizatsiya-sobytiy-vhoda">Кластеризация событий входа</h2>

login_events = events_df[events_df['ID'] == 4624].copy()

clustering_result = cluster_events(login_events)



print(f"Found {len(clustering_result['cluster_stats'])-1} clusters")

print(f"Noise points: {clustering_result['noise_points']}")

print("Cluster statistics:")

print(clustering_result['cluster_stats'])

<h2 id="skript-dlya-ezhednevnogo-analiza-event-logs">Скрипт для ежедневного анализа Event Logs</h2>

function Invoke-DailyEventLogAnalysis {

    param(

        [string]$OutputPath = "C:\Reports\EventLogs",

        [int]$DaysBack = 1

    )

    

    $startDate = (Get-Date).AddDays(-$DaysBack)

    $reportDate = Get-Date -Format "yyyy-MM-dd"

    

    # Создание директории отчетов

    New-Item -ItemType Directory -Force -Path $OutputPath | Out-Null

    

    # 1. Анализ входов пользователей

    $loginEvents = Get-WinEvent -FilterHashtable @{

        LogName = 'Security'

        ID = 4624,4625

        StartTime = $startDate

    }

    

    $loginReport = $loginEvents | Group-Object {

        $_.Properties[5].Value  # Username

    } | Select-Object Name, Count, 

        @{Name='SuccessRate';Expression={

            $total = $_.Group.Count

            $success = ($_.Group | Where-Object { $_.ID -eq 4624 }).Count

            [math]::Round(($success / $total) * 100, 2)

        }}

    

    # 2. Анализ системных ошибок

    $systemErrors = Get-WinEvent -FilterHashtable @{

        LogName = 'System'

        Level = 2,3  # Error, Warning

        StartTime = $startDate

    }

    

    $errorReport = $systemErrors | Group-Object ProviderName | 

        Select-Object Name, Count | Sort-Object Count -Descending

    

    # 3. Анализ активности Windows Defender

    $defenderEvents = Get-WinEvent -FilterHashtable @{

        ProviderName = 'Microsoft-Windows-Windows Defender'

        StartTime = $startDate

    }

    

    $defenderStats = $defenderEvents | Group-Object ID | 

        Select-Object @{Name='EventType';Expression={

            switch ($_.Name) {

                1001 { 'Threat Detected' }

                1006 { 'Threat Action Taken' }

                1008 { 'Threat Quarantined' }

                1015 { 'Threat Removed' }

                default { $_.Name }

            }

        }}, Count

    

    # 4. Анализ сетевых подключений

    $networkEvents = Get-WinEvent -FilterHashtable @{

        LogName = 'Security'

        ID = 5156,5158  # Connection events

        StartTime = $startDate

    }

    

    $networkStats = $networkEvents | Group-Object {

        $_.Properties[3].Value  # Process name

    } | Select-Object Name, Count | Sort-Object Count -Descending | Select-Object -First 10

    

    # Создание HTML отчета

    $htmlReport = @"

<!DOCTYPE html>

<html>

<head>

    <title>Daily Event Log Analysis - $reportDate</title>

    <style>

        body { font-family: Arial, sans-serif; margin: 20px; }

        .section { margin-bottom: 30px; }

        .header { color: #2E86AB; border-bottom: 2px solid #2E86AB; padding-bottom: 5px; }

        table { border-collapse: collapse; width: 100%; margin-top: 10px; }

        th, td { border: 1px solid #ddd; padding: 8px; text-align: left; }

        th { background-color: #f2f2f2; }

        .success { color: green; }

        .warning { color: orange; }

        .error { color: red; }

        .summary { background-color: #e8f4fd; padding: 15px; border-radius: 5px; }

    </style>

</head>

<body>

    <h1>Daily Event Log Analysis Report</h1>

    <div class="summary">

        <h3>Report Summary</h3>

        <p><strong>Analysis Period:</strong> $((Get-Date $startDate -Format 'yyyy-MM-dd')) to $reportDate</p>

        <p><strong>Total Events Analyzed:</strong> $(($loginEvents.Count + $systemErrors.Count + $defenderEvents.Count + $networkEvents.Count))</p>

        <p><strong>Generated:</strong> $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')</p>

    </div>

    

    <div class="section">

        <h2 class="header">User Authentication Summary</h2>

        <table>

            <thead>

                <tr>

                    <th>Username</th>

                    <th>Total Attempts</th>

                    <th>Success Rate (%)</th>

                </tr>

            </thead>

            <tbody>

"@



    foreach ($user in $loginReport) {

        $successClass = if ([double]$user.SuccessRate -ge 95) { 'success' } elseif ([double]$user.SuccessRate -ge 80) { 'warning' } else { 'error' }

        $htmlReport += @"

                <tr>

                    <td>$($user.Name)</td>

                    <td>$($user.Count)</td>

                    <td class='$successClass'>$($user.SuccessRate)%</td>

                </tr>

"@

    }



    $htmlReport += @"

            </tbody>

        </table>

    </div>

    

    <div class="section">

        <h2 class="header">System Errors and Warnings</h2>

        <table>

            <thead>

                <tr>

                    <th>Source</th>

                    <th>Error Count</th>

                </tr>

            </thead>

            <tbody>

"@



    foreach ($error in $errorReport) {

        $htmlReport += @"

                <tr>

                    <td>$($error.Name)</td>

                    <td>$($error.Count)</td>

                </tr>

"@

    }



    $htmlReport += @"

            </tbody>

        </table>

    </div>

    

    <div class="section">

        <h2 class="header">Windows Defender Activity</h2>

        <table>

            <thead>

                <tr>

                    <th>Event Type</th>

                    <th>Count</th>

                </tr>

            </thead>

            <tbody>

"@



    foreach ($event in $defenderStats) {

        $htmlReport += @"

                <tr>

                    <td>$($event.EventType)</td>

                    <td>$($event.Count)</td>

                </tr>

"@

    }



    $htmlReport += @"

            </tbody>

        </table>

    </div>

    

    <div class="section">

        <h2 class="header">Top Network Processes</h2>

        <table>

            <thead>

                <tr>

                    <th>Process</th>

                    <th>Connection Events</th>

                </tr>

            </thead>

            <tbody>

"@



    foreach ($process in $networkStats) {

        $htmlReport += @"

                <tr>

                    <td>$($process.Name)</td>

                    <td>$($process.Count)</td>

                </tr>

"@

    }



    $htmlReport += @"

            </tbody>

        </table>

    </div>

</body>

</html>

"@



    # Сохранение отчета

    $reportPath = Join-Path $OutputPath "EventLog_Analysis_$reportDate.html"

    $htmlReport | Out-File -FilePath $reportPath -Encoding UTF8

    

    Write-Host "Daily analysis report generated: $reportPath"

    

    # Возврат результатов для дальнейшего использования

    return @{

        LoginReport = $loginReport

        ErrorReport = $errorReport

        DefenderStats = $defenderStats

        NetworkStats = $networkStats

        ReportPath = $reportPath

    }

}



<h2 id="zapusk-ezhednevnogo-analiza">Запуск ежедневного анализа</h2>

$analysisResults = Invoke-DailyEventLogAnalysis -OutputPath "C:\Reports\EventLogs" -DaysBack 1

import pandas as pd

import matplotlib.pyplot as plt

import seaborn as sns

from datetime import datetime, timedelta

import subprocess

import json



def automated_event_analysis(days_back=7, output_dir='reports'):

    """

    Автоматизированный анализ Event Logs с визуализацией

    """

    # Получение данных через PowerShell

    ps_command = f'''

    $events = Get-WinEvent -FilterHashtable @{{

        LogName = 'Security','System','Application'

        StartTime = (Get-Date).AddDays(-{days_back})

    }} | Select-Object TimeCreated, LogName, ID, Level, ProviderName, Message

    

    $events | ConvertTo-Json -Compress

    '''

    

    result = subprocess.run(['powershell', '-Command', ps_command], 

                          capture_output=True, text=True, encoding='utf-8')

    

    if result.returncode != 0:

        print(f"Error running PowerShell: {result.stderr}")

        return None

    

    # Парсинг JSON данных

    try:

        events_data = json.loads(result.stdout)

        df = pd.DataFrame(events_data)

    except json.JSONDecodeError:

        print("Error parsing JSON data")

        return None

    

    # Преобразование данных

    df['TimeCreated'] = pd.to_datetime(df['TimeCreated'])

    df['Hour'] = df['TimeCreated'].dt.hour

    df['DayOfWeek'] = df['TimeCreated'].dt.day_name()

    df['Date'] = df['TimeCreated'].dt.date

    

    # Создание отчетов

    import os

    os.makedirs(output_dir, exist_ok=True)

    

    # 1. Общая статистика

    summary_stats = {

        'total_events': len(df),

        'date_range': f"{df['TimeCreated'].min()} to {df['TimeCreated'].max()}",

        'unique_event_ids': df['ID'].nunique(),

        'unique_providers': df['ProviderName'].nunique()

    }

    

    # 2. Анализ по журналам

    log_stats = df.groupby('LogName').agg({

        'ID': 'count',

        'Level': lambda x: (x <= 2).sum()  # Errors and critical

    }).rename(columns={'ID': 'total_events', 'Level': 'error_events'})

    

    # 3. Анализ по времени

    hourly_stats = df.groupby('Hour').size()

    daily_stats = df.groupby('Date').size()

    

    # 4. Топ событий

    top_events = df.groupby(['LogName', 'ID']).size().sort_values(ascending=False).head(20)

    

    # 5. Анализ ошибок

    error_df = df[df['Level'] <= 2]

    error_stats = error_df.groupby('ProviderName').size().sort_values(ascending=False).head(10)

    

    # Создание визуализаций

    plt.style.use('default')

    

    # График распределения по часам

    plt.figure(figsize=(12, 6))

    hourly_stats.plot(kind='bar', color='skyblue')

    plt.title('Event Distribution by Hour')

    plt.xlabel('Hour of Day')

    plt.ylabel('Number of Events')

    plt.xticks(rotation=0)

    plt.tight_layout()

    plt.savefig(f'{output_dir}/hourly_distribution.png')

    plt.close()

    

    # График по дням

    plt.figure(figsize=(12, 6))

    daily_stats.plot(kind='line', marker='o', color='red')

    plt.title('Daily Event Trend')

    plt.xlabel('Date')

    plt.ylabel('Number of Events')

    plt.xticks(rotation=45)

    plt.grid(True, alpha=0.3)

    plt.tight_layout()

    plt.savefig(f'{output_dir}/daily_trend.png')

    plt.close()

    

    # Круговая диаграмма по журналам

    plt.figure(figsize=(8, 8))

    log_counts = df['LogName'].value_counts()

    plt.pie(log_counts.values, labels=log_counts.index, autopct='%1.1f%%', startangle=90)

    plt.title('Events by Log Type')

    plt.axis('equal')

    plt.savefig(f'{output_dir}/log_distribution.png')

    plt.close()

    

    # Создание HTML отчета

    html_report = f"""

    <!DOCTYPE html>

    <html>

    <head>

        <title>Automated Event Log Analysis Report</title>

        <style>

            body {{ font-family: Arial, sans-serif; margin: 20px; }}

            .summary {{ background-color: #e8f4fd; padding: 20px; border-radius: 5px; margin-bottom: 20px; }}

            .chart {{ margin: 20px 0; text-align: center; }}

            table {{ border-collapse: collapse; width: 100%; margin: 20px 0; }}

            th, td {{ border: 1px solid #ddd; padding: 8px; text-align: left; }}

            th {{ background-color: #f2f2f2; }}

            .section {{ margin-bottom: 30px; }}

        </style>

    </head>

    <body>

        <h1>Automated Event Log Analysis Report</h1>

        

        <div class="summary">

            <h2>Summary</h2>

            <p><strong>Analysis Period:</strong> {days_back} days back</p>

            <p><strong>Total Events:</strong> {summary_stats['total_events']:,}</p>

            <p><strong>Unique Event IDs:</strong> {summary_stats['unique_event_ids']}</p>

            <p><strong>Unique Providers:</strong> {summary_stats['unique_providers']}</p>

            <p><strong>Date Range:</strong> {summary_stats['date_range']}</p>

        </div>

        

        <div class="section">

            <h2>Events by Log Type</h2>

            <table>

                <thead>

                    <tr>

                        <th>Log Name</th>

                        <th>Total Events</th>

                        <th>Error Events</th>

                        <th>Error Rate (%)</th>

                    </tr>

                </thead>

                <tbody>

    """

    

    for log_name, stats in log_stats.iterrows():

        error_rate = (stats['error_events'] / stats['total_events'] * 100) if stats['total_events'] > 0 else 0

        html_report += f"""

                    <tr>

                        <td>{log_name}</td>

                        <td>{stats['total_events']:,}</td>

                        <td>{stats['error_events']:,}</td>

                        <td>{error_rate:.1f}%</td>

                    </tr>

        """

    

    html_report += f"""

                </tbody>

            </table>

        </div>

        

        <div class="section">

            <h2>Top Events</h2>

            <table>

                <thead>

                    <tr>

                        <th>Log Name</th>

                        <th>Event ID</th>

                        <th>Count</th>

                    </tr>

                </thead>

                <tbody>

    """

    

    for (log_name, event_id), count in top_events.items():

        html_report += f"""

                    <tr>

                        <td>{log_name}</td>

                        <td>{event_id}</td>

                        <td>{count:,}</td>

                    </tr>

        """

    

    html_report += f"""

                </tbody>

            </table>

        </div>

        

        <div class="section">

            <h2>Top Error Sources</h2>

            <table>

                <thead>

                    <tr>

                        <th>Provider Name</th>

                        <th>Error Count</th>

                    </tr>

                </thead>

                <tbody>

    """

    

    for provider, count in error_stats.items():

        html_report += f"""

                    <tr>

                        <td>{provider}</td>

                        <td>{count:,}</td>

                    </tr>

        """

    

    html_report += f"""

                </tbody>

            </table>

        </div>

        

        <div class="chart">

            <h2>Hourly Distribution</h2>

            <img src="hourly_distribution.png" alt="Hourly Distribution" style="max-width: 100%;">

        </div>

        

        <div class="chart">

            <h2>Daily Trend</h2>

            <img src="daily_trend.png" alt="Daily Trend" style="max-width: 100%;">

        </div>

        

        <div class="chart">

            <h2>Log Distribution</h2>

            <img src="log_distribution.png" alt="Log Distribution" style="max-width: 100%;">

        </div>

        

        <p><em>Report generated on {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}</em></p>

    </body>

    </html>

    """

    

    # Сохранение HTML отчета

    with open(f'{output_dir}/analysis_report.html', 'w', encoding='utf-8') as f:

        f.write(html_report)

    

    print(f"Analysis complete. Reports saved to {output_dir}")

    

    return {

        'summary': summary_stats,

        'log_stats': log_stats,

        'top_events': top_events,

        'error_stats': error_stats,

        'hourly_stats': hourly_stats,

        'daily_stats': daily_stats

    }



<h2 id="zapusk-avtomatizirovannogo-analiza">Запуск автоматизированного анализа</h2>

results = automated_event_analysis(days_back=7, output_dir='automated_reports')

from elasticsearch import Elasticsearch

import json



def send_events_to_elk(events_df, elk_host='localhost', elk_port=9200):

    """

    Отправка событий в Elasticsearch

    """

    es = Elasticsearch([{'host': elk_host, 'port': elk_port}])

    

    # Подготовка данных для индексации

    bulk_data = []

    index_name = f'windows-events-{datetime.now().strftime("%Y.%m.%d")}'

    

    for _, event in events_df.iterrows():

        # Создание документа

        doc = {

            '@timestamp': event['TimeCreated'].isoformat(),

            'log_name': event['LogName'],

            'event_id': event['ID'],

            'level': event['Level'],

            'provider': event['ProviderName'],

            'message': event['Message'],

            'computer': event.get('Computer', 'Unknown')

        }

        

        # Добавление в bulk запрос

        bulk_data.append({'index': {'_index': index_name}})

        bulk_data.append(doc)

    

    # Отправка bulk запроса

    if bulk_data:

        response = es.bulk(body=bulk_data, refresh=True)

        if response['errors']:

            print(f"Errors occurred: {response['errors']}")

        else:

            print(f"Successfully indexed {len(bulk_data)//2} events")

    

    return response



<h2 id="ispolzovanie">Использование</h2>

send_events_to_elk(events_df)

import splunklib.client as client



def send_to_splunk(events_df, splunk_host, username, password):

    """

    Отправка событий в Splunk

    """

    # Подключение к Splunk

    service = client.connect(host=splunk_host, username=username, password=password)

    

    # Создание индекса для Windows событий

    try:

        service.indexes.create('windows_events')

    except:

        pass  # Индекс уже существует

    

    index = service.indexes['windows_events']

    

    # Отправка событий

    for _, event in events_df.iterrows():

        event_data = {

            'time': event['TimeCreated'].timestamp(),

            'event': {

                'log_name': event['LogName'],

                'event_id': event['ID'],

                'level': event['Level'],

                'provider': event['ProviderName'],

                'message': event['Message']

            }

        }

        

        index.submit(json.dumps(event_data), sourcetype='windows:eventlog')

    

    print(f"Sent {len(events_df)} events to Splunk")



<h2 id="ispolzovanie">Использование</h2>

send_to_splunk(events_df, 'splunk-server.company.com', 'admin', 'password')

<h2 id="skript-dlya-avtomaticheskogo-reagirovaniya-na-sobytiya">Скрипт для автоматического реагирования на события</h2>

function Start-EventDrivenResponse {

    # Мониторинг критических событий

    $criticalEvents = @(

        @{ ID = 4625; LogName = 'Security'; Action = 'Alert' },  # Failed login

        @{ ID = 1102; LogName = 'Security'; Action = 'Lockdown' }, # Audit log cleared

        @{ ID = 1001; LogName = 'System'; Action = 'RestartCheck' }, # System crash

        @{ ID = 1006; LogName = 'Application'; Action = 'DefenderCheck' } # Defender detection

    )

    

    # Создание подписок на события

    foreach ($event in $criticalEvents) {

        $query = @"

<QueryList>

  <Query Id="0" Path="$($event.LogName)">

    <Select Path="$($event.LogName)">

      *[System[EventID=$($event.ID)]]

    </Select>

  </Query>

</QueryList>

"@

        

        Register-WmiEvent -Query "SELECT * FROM Win32_NTLogEvent WHERE Logfile='$($event.LogName)' AND EventCode=$($event.ID)" -Action {

            param($wmiEvent)

            

            $eventData = $wmiEvent.InsertionStrings

            

            switch ($event.Action) {

                'Alert' {

                    # Отправка оповещения

                    $alertMessage = "CRITICAL EVENT: Failed login attempt from $($eventData[19])"

                    Write-Host $alertMessage -ForegroundColor Red

                    

                    # Можно добавить отправку email, Slack, Teams и т.д.

                }

                

                'Lockdown' {

                    # Реакция на очистку логов

                    Write-Host "SECURITY ALERT: Audit log was cleared!" -ForegroundColor Red

                    # Запуск дополнительных проверок безопасности

                }

                

                'RestartCheck' {

                    # Проверка после сбоя системы

                    Write-Host "SYSTEM CRASH DETECTED: Checking system stability..." -ForegroundColor Yellow

                    # Запуск диагностики

                }

                

                'DefenderCheck' {

                    # Реакция на обнаружение Defender

                    Write-Host "MALWARE DETECTED: Running additional scans..." -ForegroundColor Red

                    # Запуск дополнительного сканирования

                }

            }

            

            # Логирование реакции

            $logEntry = "$(Get-Date): Automated response to Event ID $($event.ID) - Action: $($event.Action)"

            Add-Content -Path 'automated_responses.log' -Value $logEntry

        }

    }

}



<h2 id="zapusk-sistemy-reagirovaniya">Запуск системы реагирования</h2>

Start-EventDrivenResponse

<h2 id="sozdanie-ezhednevnoy-zadachi-analiza">Создание ежедневной задачи анализа</h2>

$taskName = "Daily Event Log Analysis"

$scriptPath = "C:\Scripts\DailyEventAnalysis.ps1"

$taskAction = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-File $scriptPath"

$taskTrigger = New-ScheduledTaskTrigger -Daily -At "06:00"

$taskSettings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries

$taskPrincipal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount



Register-ScheduledTask -TaskName $taskName -Action $taskAction -Trigger $taskTrigger -Settings $taskSettings -Principal $taskPrincipal -Description "Daily automated analysis of Windows Event Logs"



Write-Host "Scheduled task created: $taskName"

<h2 id="poluchenie-vseh-sobytiy-vhoda-administratora">Получение всех событий входа администратора</h2>

$adminEvents = Get-WinEvent -FilterHashtable @{

    LogName = 'Security'

    ID = 4624,4625,4634,4648,4672

    StartTime = (Get-Date).AddDays(-30)

} | Where-Object {

    $_.Properties[5].Value -eq 'Administrator' -or 

    $_.Properties[6].Value -eq 'DOMAIN'

}

<h2 id="gruppirovka-po-ip-i-vremeni">Группировка по IP и времени</h2>

$suspiciousLogons = $adminEvents | Where-Object { $_.ID -eq 4624 } | Group-Object {

    $ip = $_.Properties[18].Value

    $date = $_.TimeCreated.Date

    "$ip|$date"

} | Where-Object { $_.Count -gt 3 }



<h2 id="poisk-neobychnyh-tipov-vhoda">Поиск необычных типов входа</h2>

$unusualLogons = $adminEvents | Where-Object {

    $_.ID -eq 4624 -and $_.Properties[8].Value -notin 2,10  # Не интерактивный и не RDP

}

<h2 id="poisk-deystviy-posle-vhoda">Поиск действий после входа</h2>

foreach ($logon in $adminEvents | Where-Object { $_.ID -eq 4624 }) {

    $logonTime = $logon.TimeCreated

    $logonId = $logon.Properties[7].Value

    

    # Поиск действий с тем же Logon ID

    $postLogonEvents = Get-WinEvent -FilterHashtable @{

        LogName = 'Security'

        StartTime = $logonTime

        EndTime = $logonTime.AddHours(2)

    } | Where-Object {

        $_.Properties[5].Value -eq $logonId -and $_.ID -in 4688,4663,4656

    }

    

    if ($postLogonEvents) {

        Write-Host "Logon at $($logon.TimeCreated) from $($logon.Properties[18].Value)"

        Write-Host "Post-logon activities: $($postLogonEvents.Count)"

    }

}

<h2 id="poluchenie-sobytiy-obnaruzheniya">Получение событий обнаружения</h2>

$defenderDetections = Get-WinEvent -FilterHashtable @{

    ProviderName = 'Microsoft-Windows-Windows Defender'

    ID = 1001,1006,1008,1015

    StartTime = (Get-Date).AddDays(-7)

}



<h2 id="analiz-obnaruzhennyh-ugroz">Анализ обнаруженных угроз</h2>

foreach ($detection in $defenderDetections) {

    $threatName = $detection.Properties[1].Value

    $threatPath = $detection.Properties[2].Value

    Write-Host "Threat detected: $threatName at $threatPath"

}

<h2 id="poisk-sozdaniya-podozritelnyh-protsessov">Поиск создания подозрительных процессов</h2>

$suspiciousProcesses = Get-WinEvent -FilterHashtable @{

    LogName = 'Security'

    ID = 4688

    StartTime = (Get-Date).AddDays(-7)

} | Where-Object {

    $_.Properties[9].Value -match '\.(exe|dll|bat|ps1|vbs|js)$' -and

    $_.Properties[11].Value -notmatch 'C:\\Windows\\|C:\\Program Files'

}

<h2 id="poisk-podozritelnyh-podklyucheniy">Поиск подозрительных подключений</h2>

$suspiciousConnections = Get-WinEvent -FilterHashtable @{

    LogName = 'Security'

    ID = 5156,5158

    StartTime = (Get-Date).AddDays(-7)

} | Where-Object {

    $_.Properties[3].Value -match 'powershell|cmd|wscript|cscript' -and

    $_.Properties[5].Value -notmatch '^192\.168\.|^10\.|^172\.'

}

<h2 id="poisk-sobytiy-dostupa-k-faylam">Поиск событий доступа к файлам</h2>

$fileAccessEvents = Get-WinEvent -FilterHashtable @{

    LogName = 'Security'

    ID = 4663

    StartTime = (Get-Date).AddDays(-30)

} | Where-Object {

    $_.Properties[6].Value -match 'secret|confidential|private'

}



<h2 id="analiz-po-polzovatelyam">Анализ по пользователям</h2>

$userAccess = $fileAccessEvents | Group-Object {

    $_.Properties[1].Value  # Subject User Name

} | Select-Object Name, Count | Sort-Object Count -Descending

<h2 id="poisk-sobytiy-sozdaniya-zapisi-faylov">Поиск событий создания/записи файлов</h2>

$fileOperations = Get-WinEvent -FilterHashtable @{

    LogName = 'Security'

    ID = 4656,4658,4660,4663

    StartTime = (Get-Date).AddDays(-30)

} | Where-Object {

    $_.Properties[6].Value -match '\\\\.*\\.*'  # Сетевые пути

}

<h2 id="sozdanie-timeline-sobytiy">Создание timeline событий</h2>

$timeline = ($fileAccessEvents + $fileOperations) | 

    Sort-Object TimeCreated | 

    Select-Object TimeCreated, ID, 

        @{Name='User';Expression={$_.Properties[1].Value}},

        @{Name='Object';Expression={$_.Properties[6].Value}},

        @{Name='Action';Expression={

            switch ($_.ID) {

                4656 { 'Access Request' }

                4658 { 'Handle Created' }

                4660 { 'Object Deleted' }

                4663 { 'Read Access' }

            }

        }}

<h2 id="poisk-sobytiy-perezagruzki">Поиск событий перезагрузки</h2>

$restartEvents = Get-WinEvent -FilterHashtable @{

    LogName = 'System'

    ID = 1074,6006,6008

    StartTime = (Get-Date).AddDays(-7)

}



foreach ($event in $restartEvents) {

    Write-Host "Restart event: $($event.ID) at $($event.TimeCreated)"

    Write-Host "Reason: $($event.Message)"

}

<h2 id="poluchenie-vremeni-poslednego-sboya">Получение времени последнего сбоя</h2>

$lastCrash = $restartEvents | Where-Object { $_.ID -eq 6008 } | Select-Object -First 1



if ($lastCrash) {

    $crashTime = $lastCrash.TimeCreated

    

    # Анализ событий за час до сбоя

    $preCrashEvents = Get-WinEvent -FilterHashtable @{

        LogName = 'System','Application'

        Level = 2,3  # Errors and warnings

        StartTime = $crashTime.AddHours(-1)

        EndTime = $crashTime

    }

    

    Write-Host "Events before crash:"

    $preCrashEvents | Select-Object TimeCreated, LogName, ID, LevelDisplayName, ProviderName | Format-Table -AutoSize

}

<h2 id="poisk-sobytiy-nehvatki-resursov">Поиск событий нехватки ресурсов</h2>

$resourceEvents = Get-WinEvent -FilterHashtable @{

    LogName = 'System'

    ID = 1009,2019,2020

    StartTime = (Get-Date).AddDays(-7)

}



if ($resourceEvents) {

    Write-Host "Resource exhaustion events:"

    $resourceEvents | Select-Object TimeCreated, ID, Message | Format-Table -AutoSize

}

<h2 id="poisk-sobytiy-spetsialnyh-privilegiy">Поиск событий специальных привилегий</h2>

$privilegeEvents = Get-WinEvent -FilterHashtable @{

    LogName = 'Security'

    ID = 4672,4673,4674

    StartTime = (Get-Date).AddDays(-7)

}



foreach ($event in $privilegeEvents) {

    $user = $event.Properties[1].Value

    $privileges = $event.Properties[3].Value

    Write-Host "User $user obtained privileges: $privileges"

}

<h2 id="poisk-sobytiy-sozdaniya-protsessov-s-povyshennymi-pravami">Поиск событий создания процессов с повышенными правами</h2>

$elevatedProcesses = Get-WinEvent -FilterHashtable @{

    LogName = 'Security'

    ID = 4688

    StartTime = (Get-Date).AddDays(-7)

} | Where-Object {

    $_.Properties[15].Value -match 'TokenElevationTypeFull|TokenElevationTypeLimited'

}

<h2 id="poisk-popytok-dostupa-k-sam-system-i-drugim-chuvstvitelnym-faylam">Поиск попыток доступа к SAM, SYSTEM и другим чувствительным файлам</h2>

$sensitiveAccess = Get-WinEvent -FilterHashtable @{

    LogName = 'Security'

    ID = 4656,4663

    StartTime = (Get-Date).AddDays(-7)

} | Where-Object {

    $_.Properties[6].Value -match 'SAM|SYSTEM|NTDS\.DIT|lsass\.exe'

}