tyler.durden
/
pandorafms
mirror of https://github.com/pandorafms/pandorafms.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Capture security and system events on windows.

This commit is contained in:
felix.suarez 2023-11-29 11:44:02 -06:00
parent 8940e2b9aa
commit dbd7de857b
2 changed files with 24 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
pandora_agents/pc/Win32/pandora_agent.conf
View File

@ -147,22 +147,23 @@ module_max_critical 20
module_end module_end
# Log events # Log events
# Get logs from System source.
module_begin module_begin
module_name System Events (TermService) module_name System Events (TermService)
module_type async_string
module_logevent
module_description Log Events coming from Terminal Service module_description Log Events coming from Terminal Service
module_type log
module_logevent
module_source System module_source System
module_application TermService
module_end module_end
# Get logs from Security source.
module_begin module_begin
module_name Security Events (Invalid Login) module_name Security Events
module_type async_string module_description Security log events
module_description Security log events for invalid login attempt module_type log
module_logevent module_logevent
module_source Security module_source Security
module_eventcode 529
module_end module_end
# Check if Dhcp service is enabled # Check if Dhcp service is enabled

32
pandora_agents/win32/bin/pandora_agent.conf
View File

@ -179,6 +179,22 @@ module_description Total number of TCP connections active
module_group Networking module_group Networking
module_end module_end
# Get logs from System source.
module_begin
module_name Eventlog_System
module_type log
module_logevent
module_source System
module_end
# Get logs from Security source.
module_begin
module_name Eventlog_Security
module_type log
module_logevent
module_source Security
module_end
# Example plugin to retrieve drive usage # Example plugin to retrieve drive usage
module_plugin cscript.exe //B "%ProgramFiles%\Pandora_Agent\util\df_percent_used.vbs" module_plugin cscript.exe //B "%ProgramFiles%\Pandora_Agent\util\df_percent_used.vbs"
@ -273,22 +289,6 @@ module_plugin "%PROGRAMFILES%\Pandora_Agent\util\autodiscover.exe" --default
#module_type generic_data_string #module_type generic_data_string
#module_end #module_end
# Get logs from System source. Need enterprise version.
#module_begin
#module_name Eventlog_System
#module_type log
#module_logevent
#module_source System
#module_end
# Get logs from Security source. Need enterprise version.
#module_begin
#module_name Eventlog_Security
#module_type log
#module_logevent
#module_source Security
#module_end
# Get logs from Application source. Need enterprise version. # Get logs from Application source. Need enterprise version.
#module_begin #module_begin
#module_name Eventlog_Application #module_name Eventlog_Application