What the Log?! So Many Events, so Little Time...
summary
Claims that applying Microsoft security baselines creates many new Windows Event IDs (documentation is 754 pages) and that median breach detection takes >200 days, then shows an automated tool that parses baselines into usable artifacts. It builds Event List PowerShell GUI and a CLI, produces event lists with event ID, link and monitor recommendation, auto-generates agent configs (Splunk, XPath, MDATP) via get-agent-config-string, and converts events to hunting queries using Sigma conversion to Splunk/MDATP while exporting YAML/CSV and GPOs.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 0:56Microsoft Security Compliance Toolkit
- 2:45Audit Policies
- 4:23Customer Request
- 5:26Automate Event List
- 6:28Mitre Attack
- 7:18Mitre Sources
- 8:06Three Questions
- 9:32GUI
- 10:31Power Event List
- 16:23Generate Event List
- 24:31Generate Hunting Queries
- 25:26Generate Event List Queries
- 28:41Configure Event List
- 29:21Generate Queries
- 36:21Other Options
related talks
46mParsing Event Logs for FREE
43mHow to Tame the Event Log Beast
45mWatch the Gaps: Detecting (and Fixing!) Overlooked Windows Event Log Misses
52mDetecting Malicious Activity: Unveiling the Secrets of MS-SQL Logging
32mSysmon Deep Dive: Real Detection Scenarios You Can Reproduce
50mAutomating security monitoring
28mLets Make Needles Glow in Timesketch
57mSecuring PowerShell: Hands-On Lab