{"id":22021978,"url":"https://github.com/knightchaser/docker-elk-winlogbeat","last_synced_at":"2026-04-20T05:31:51.584Z","repository":{"id":217640787,"uuid":"744422387","full_name":"KnightChaser/docker-elk-winlogbeat","owner":"KnightChaser","description":"Integrated Windows endpoint log management (Docker + ELK(ElasticSearch, Logstash, Kibana) + Winlogbeat based)","archived":false,"fork":false,"pushed_at":"2024-01-17T11:11:40.000Z","size":960,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-01-28T16:46:50.972Z","etag":null,"topics":["docker-elk","elasticsearch","elasticsearch-server","elk","elk-stack","sysmon","windows","winlogbeat"],"latest_commit_sha":null,"homepage":"https://www.elastic.co/","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/KnightChaser.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2024-01-17T09:14:22.000Z","updated_at":"2024-07-05T03:59:41.000Z","dependencies_parsed_at":"2024-01-17T17:30:52.089Z","dependency_job_id":null,"html_url":"https://github.com/KnightChaser/docker-elk-winlogbeat","commit_stats":null,"previous_names":["knightchaser/docker-elk-winlogbeat"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KnightChaser%2Fdocker-elk-winlogbeat","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KnightChaser%2Fdocker-elk-winlogbeat/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KnightChaser%2Fdocker-elk-winlogbeat/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KnightChaser%2Fdocker-elk-winlogbeat/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/KnightChaser","download_url":"https://codeload.github.com/KnightChaser/docker-elk-winlogbeat/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245086237,"owners_count":20558544,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["docker-elk","elasticsearch","elasticsearch-server","elk","elk-stack","sysmon","windows","winlogbeat"],"created_at":"2024-11-30T06:16:57.386Z","updated_at":"2026-04-20T05:31:46.534Z","avatar_url":"https://github.com/KnightChaser.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# docker-elk-winlogbeat\n\n![ElasticSearch](https://img.shields.io/badge/-ElasticSearch-005571?style=for-the-badge\u0026logo=elasticsearch)\n![Ubuntu](https://img.shields.io/badge/Ubuntu-E95420?style=for-the-badge\u0026logo=ubuntu\u0026logoColor=white)\n![Windows](https://img.shields.io/badge/Windows-0078D6?style=for-the-badge\u0026logo=windows\u0026logoColor=white)\n\n\n### **Integrated Windows endpoint log management** (Docker + ELK(ElasticSearch, Logstash, Kibana) + Winlogbeat based)\n\u003e **Preview**\u003cbr\u003e\u003cimg src=\"./_readme_asset/preview.png\"\u003e\n\n**Tested environments**\n- ELK Server(Management server); Ubuntu 22.04.6 LTS, 64bits\n- ELK Client(Windows endpoint); Windows 10 Home, 64bits\n- ELK stack version `7.1.1`(Elasticsearch, Logstash, Kibana + winlogbeats)\n- Both server and client are interconnected in the VMWare virtualization environment, a network configured as NAT(Network Address Translation) mode.\n\n### **Overall mechanism**\n\u003cimg src=\"./_readme_asset/elk_stack_diagram.png\"\u003e\n\n* Via **winlogbeat**, relay gathers activity information from **sysmon** on the WIndows endpoint to **logstash** on ELK server.\n* **logstash** reads, parses, transforms, and relays the data to **elasticsearch**.\n* **kibana** searches and visualizes the information from **elasticsearch**.\n\n\n### Setup\n* **ELK server** (suppose the IP address is `192.168.133.141/24`)\n    * Create or navigate the empty dedicated directory.\n    * Install `git`, `docker`, and `docker-compose`.\n    * Get the environment `git clone https://github.com/KnightChaser/docker-elk-winlogbeat.git` at once.\n    * Check the configuration files. (Below is an explanation. You don't need to change this if you just want to use as default.)\n        * `docker-compose.yml` is for overall docker configuration setup. To make it simple, this project uses `7.1.1` version instead of `8`, not to consider about the enrollment token and miscellaneous security settings. Also, **port** configuration will be standardized according to this yml file. Other applications or setting files shouldn't have any conflict with this file.\n        ```yml\n        # We will use ELK stack families with version of 7.1.1 (even including winlogbeat)\n            elasticsearch:\n                image: docker.elastic.co/elasticsearch/elasticsearch:7.1.1\n                    ports:\n                    - 9200:9200\n                    - 9300:9300\n                # ...\n            logstash:\n                image: docker.elastic.co/logstash/logstash:7.1.1\n                    ports:\n                    - 5044:5044\n                    - 5000:5000/tcp   # \u003c--- logstash will communicate with winlogbeat installed on Windows endpoint via this port (:5000 in this case.)\n                    - 5000:5000/udp\n                    - 9600:9600\n                # ...\n            kibana:\n                image: docker.elastic.co/kibana/kibana:7.1.1\n                    ports:\n                    - 5601:5601\n                # ...\n        ```\n        * `elasticsearch/config/elasticsearch.yml` is for Elasticsearch configuration. To make this service is accessible by everyone, I set `network.host` property as `0.0.0.0`.\n        ```yml\n        cluster.name: \"docker-cluster\" \n        network.host: 0.0.0.0 \n        discovery.type: single-node\n        ```\n        * `kibana/config/kibana.yml` is for Kibana configuration. Because Kibana receives and interacts with Elasticsearch, Port number setting should be identical with `docker-compose.yml`.\n        ```yml\n        server.name: kibana\n        server.host: 0.0.0.0\n        elasticsearch.hosts: [ \"http://elasticsearch:9200\" ]\n        xpack.monitoring.ui.container.elasticsearch.enabled: true\n        ```\n        * `logstash/config/logstash.yml` is for Logstash configuration connected to elasticsearch(forwarding parsed and transformed data.). Port number setting should be identical with `docker-composes.yml`.\n        ```yml\n        http.host: \"0.0.0.0\"\n        xpack.monitoring.elasticsearch.hosts: [ \"http://elasticsearch:9200\" ]\n        ```\n        * `logstash/pipeline/logstash.conf` is for the Logstash pipelining configuration connected to any pre-configured Windows endpoint(from winlogbeat). `port` setting in `input` should correspond to both `docker-compose.yml` and winlogbeat YML setting file in Windows endpoint. `hosts` in `output` section describes Elasticsearch connection information. This information should be identical to `docker-compose.yml`. Other configurations may be adjusted for your needs(For parsing, indexing, transforming data during the pipelining procedure.).\n        ```\n        input {\n            beats{\n                port =\u003e 5000\n            }    \n        }\n\n        output {\n            elasticsearch {\n                hosts =\u003e \"elasticsearch:9200\"\n                user =\u003e \"username\"\n                password =\u003e \"password\"\n                index =\u003e \"%{[@metadata][beat]}-%{+YYYY.MM.dd}\"\n                document_type =\u003e \"%{[@metadata][type]}\"\n            }\n        }\n        ```\n    * Initiate the ELK server by hitting `sudo docker-compose up -d`. To terminate the server operation, hit `sudo docker-compose down -v` instead.\n    \u003cimg src=\"./_readme_asset/docker_compose.png\"\u003e\n    \n    * Complete ELK Client setup\n    * Open a web browser in the ELK server and access **`localhost:5601`**. Head to `Kibana \u003e Index patterns` and set up the GUI management panel. Define the index pattern, and find the fields. You can customize the setting, add more things to the pipeline, or build a new fancy GUI panel. Creative parts are on your hands!\n        * \u003cimg src=\"./_readme_asset/kibana_run_1.png\"\u003e\n        * \u003cimg src=\"./_readme_asset/kibana_run_1b.png\"\u003e\n        * \u003cimg src=\"./_readme_asset/kibana_run_2.png\"\u003e\n\n\u003cbr\u003e\n\u003cbr\u003e\n\n\n* **ELK Client** (suppose the IP address is `192.168.133.142/24`)\n    * Install the **sysmon**(system monitor) program from the official Microsoft webpage. (Modern versions are okay.)\n    ```\n    https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon\n    ```\n    * Download the **winlogbeat** with version of `7.1.1`. (Because ELK stack is configured as the version of `7.1.1`, matching the overall version is highly encouraged.)\n    ```\n    https://www.elastic.co/downloads/past-releases/winlogbeat-7-1-1\n    ```\n    * Test an ICMP connectivity(`ping`) between ELK servers and ELK clients. You can consider disabling the Windows firewall that blocks communications while the machines are part of the ELK stack.\n    \u003cimg src=\"./_readme_asset/disable_firewalls_win10.png\"\u003e\n\n    * Initiate sysmon. If you don't have any XML sysmon rule, you can download and use `sysmonconfig-export.yml` file as the default for sysmon. And, execute the sysmon service. (`.\\sysmon.exe --accepteula`, `.\\sysmon.exe -i \u003cpath_to\u003e\\sysmonconfig-export.xml`...)\n    ```\n    https://github.com/SwiftOnSecurity/sysmon-config/blob/master/sysmonconfig-export.xml\n    ```\n    \n    * Save the **winlogbeat** configuration with below content(**IP address/Port number should be matches with ELK server.**) file as `winlogbeat.yml` at the right directory of **winlogbeat**.\n    ```yml\n    winlogbeat.event_logs:\n        - name: Microsoft-Windows-Sysmon/Operational\n\n    output.logstash:\n        hosts: [\"192.168.133.141:5000\"]\n        index: winlogbeat\n    ```\n    - Initiate **winlogbeat**. (You can check **winlogbeat** service registry at `Services`(`Sc.exe`) utility.)\n    ```powershell\n    .\\winlogbeat.exe -c .\\winlogbeat.yml\n    .\\install-service-winlogbeat.ps1\n    .\\Start-Service winlogbeat\n    ```\n\n\n### By\n- KnightChaser (Lee Garam) [Github](https://github.com/KnightChaser/KnightChaser)\n\n### Inspired from\n- https://github.com/choisungwook/malware\n- https://github.com/justmeandopensource/elk\n- https://github.com/deviantony/docker-elk\n- https://github.com/SwiftOnSecurity/sysmon-config/blob/master/sysmonconfig-export.xml\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fknightchaser%2Fdocker-elk-winlogbeat","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fknightchaser%2Fdocker-elk-winlogbeat","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fknightchaser%2Fdocker-elk-winlogbeat/lists"}