{ "v": 1, "id": "db7c4f60-3ae9-42b4-81cf-28bc337bb611", "rev": 1, "name": "Windows Authentication Failure Monitoring for Sidecar", "summary": "Content Pack for Monitoring Authentication Failures in Windows Security Logs", "description": "A monitoring content pack that combines Input, Stream, Dashboard, Event Definitions, and Email Notification features for Windows Security log Event IDs 4625, 4771, and 4776.", "vendor": "DesigNET.inc", "url": "", "parameters": [ { "name": "input_bind_address", "title": "Input bind address", "description": "Bind address for the Windows log input. Set during content pack installation.", "type": "string", "default_value": "0.0.0.0" }, { "name": "input_port", "title": "Input port", "description": "Listening port for the Windows log input. Set during content pack installation.", "type": "integer", "default_value": 5044 }, { "name": "privileged_account_query", "title": "Privileged account query", "description": "Search query used to detect authentication failures against privileged accounts.", "type": "string", "default_value": "winlogbeat_winlog_event_data_TargetUserName:Administrator OR winlogbeat_winlog_event_data_TargetUserName:admin" } ], "entities": [ { "v": "1", "type": { "name": "input", "version": "1" }, "id": "251c3e84-73dd-46ca-a926-2e32447b16a5", "data": { "title": { "@type": "string", "@value": "Windows_client_for_sidecar" }, "configuration": { "tls_key_file": { "@type": "string", "@value": "" }, "port": { "@type": "integer", "@value": 5044 }, "tls_enable": { "@type": "boolean", "@value": false }, "recv_buffer_size": { "@type": "integer", "@value": 1048576 }, "tcp_keepalive": { "@type": "boolean", "@value": false }, "tls_client_auth_cert_file": { "@type": "string", "@value": "" }, "bind_address": { "@type": "string", "@value": "0.0.0.0" }, "no_beats_prefix": { "@type": "boolean", "@value": false }, "tls_cert_file": { "@type": "string", "@value": "" }, "tls_client_auth": { "@type": "string", "@value": "disabled" }, "charset_name": { "@type": "string", "@value": "UTF-8" }, "number_worker_threads": { "@type": "integer", "@value": 1 }, "tls_key_password": { "@type": "string", "@value": "" } }, "static_fields": {}, "type": { "@type": "string", "@value": "org.graylog.plugins.beats.Beats2Input" }, "global": { "@type": "boolean", "@value": true }, "extractors": [] }, "constraints": [ { "type": "server-version", "version": ">=7.0.5+1a1d8ce" } ] }, { "v": "1", "type": { "name": "sidecar_collector_configuration", "version": "1" }, "id": "100ed543-9b89-44c5-9d66-de583b7b9003", "data": { "collector_id": { "@type": "string", "@value": "08229417-d334-40c8-b35e-5a78d1a69afa" }, "title": { "@type": "string", "@value": "Sidecar-for-Windows-client" }, "color": { "@type": "string", "@value": "#FFFFFF" }, "template": { "@type": "string", "@value": "# Required settings\nfields_under_root: true\nfields.collector_node_id: ${sidecar.nodeName}\nfields.gl2_source_collector: ${sidecar.nodeId}\n\n\noutput.logstash:\n hosts: [\"XXX.XXX.XXX.XXX:5044\"]\npath:\n data: ${sidecar.spoolDir!\"C:\\\\Program Files\\\\Graylog\\\\sidecar\\\\cache\\\\winlogbeat\"}\\data\n logs: ${sidecar.spoolDir!\"C:\\\\Program Files\\\\Graylog\\\\sidecar\"}\\logs\ntags:\n - windows\n - winlogbeat\nwinlogbeat:\n event_logs:\n - name: Application\n ignore_older: 96h\n - name: System\n ignore_older: 96h\n - name: Security\n ignore_older: 96h\n - name: Setup\n ignore_older: 96h\n - name: ForwardedEvents\n forwarded: true\n ignore_older: 96h\n - name: Microsoft-Windows-Windows Defender/Operational\n ignore_older: 96h\n - name: Microsoft-Windows-Sysmon/Operational\n ignore_older: 96h\n - name: Microsoft-Windows-TerminalServices-LocalSessionManager/Operational\n ignore_older: 96h\n - name: Microsoft-Windows-PowerShell/Operational\n ignore_older: 96h\n - name: windows PowerShell\n ignore_older: 96h" } }, "constraints": [ { "type": "server-version", "version": ">=7.0.5+1a1d8ce" } ] }, { "v": "1", "type": { "name": "stream", "version": "1" }, "id": "a757b86e-2c34-4fd5-8506-7c1e1a8df45c", "data": { "alarm_callbacks": [], "outputs": [], "remove_matches": { "@type": "boolean", "@value": false }, "title": { "@type": "string", "@value": "Windows - Authentication Failures for Sidecar" }, "stream_rules": [ { "type": { "@type": "string", "@value": "EXACT" }, "field": { "@type": "string", "@value": "winlogbeat_winlog_event_id" }, "value": { "@type": "string", "@value": "4625" }, "inverted": { "@type": "boolean", "@value": false }, "description": { "@type": "string", "@value": "" } }, { "type": { "@type": "string", "@value": "EXACT" }, "field": { "@type": "string", "@value": "winlogbeat_winlog_event_id" }, "value": { "@type": "string", "@value": "4771" }, "inverted": { "@type": "boolean", "@value": false }, "description": { "@type": "string", "@value": "" } }, { "type": { "@type": "string", "@value": "EXACT" }, "field": { "@type": "string", "@value": "winlogbeat_winlog_event_id" }, "value": { "@type": "string", "@value": "4776" }, "inverted": { "@type": "boolean", "@value": false }, "description": { "@type": "string", "@value": "" } } ], "alert_conditions": [], "matching_type": { "@type": "string", "@value": "AND" }, "disabled": { "@type": "boolean", "@value": false }, "description": { "@type": "string", "@value": "Event Log on Windows Client" }, "default_stream": { "@type": "boolean", "@value": false } }, "constraints": [ { "type": "server-version", "version": ">=7.0.5+1a1d8ce" } ] }, { "v": "1", "type": { "name": "event_definition", "version": "1" }, "id": "d0105bfe-3fd3-4206-83a3-0287122f5098", "data": { "field_spec": {}, "config": { "query_parameters": [], "search_within_ms": 300000, "query": { "@type": "string", "@value": "winlogbeat_winlog_event_data_TargetUserName:user" }, "cron_expression": null, "cron_timezone": null, "use_cron_scheduling": false, "streams": [ "a757b86e-2c34-4fd5-8506-7c1e1a8df45c" ], "execute_every_ms": 60000, "event_limit": 100, "group_by": [], "series": [ { "type": "count", "id": "count-", "field": null } ], "conditions": { "expression": { "expr": ">=", "left": { "expr": "number-ref", "ref": "count-" }, "right": { "expr": "number", "value": 1 } } }, "type": "aggregation-v1", "stream_categories": [], "filters": [] }, "priority": { "@type": "integer", "@value": 3 }, "notifications": [ { "notification_id": { "@type": "string", "@value": "e572286d-dcf2-45b3-b22a-b7d1857e3587" }, "notification_parameters": null } ], "remediation_steps": null, "matched_at": "2026-06-08T04:40:30.674Z", "event_procedure": null, "_scope": { "@type": "string", "@value": "DEFAULT" }, "notification_settings": { "grace_period_ms": 300000, "backlog_size": 5 }, "updated_at": "2026-06-09T00:08:39.121Z", "title": { "@type": "string", "@value": "Windows Auth Failures for Sidecar - Privileged Account Failure" }, "is_scheduled": { "@type": "boolean", "@value": true }, "key_spec": [], "storage": [ { "type": "persist-to-streams-v1", "streams": [ "000000000000000000000002" ] } ], "alert": { "@type": "boolean", "@value": true }, "description": { "@type": "string", "@value": "Detect failed authentication attempts on the administrator account" } }, "constraints": [ { "type": "server-version", "version": ">=7.0.5+1a1d8ce" } ] }, { "v": "1", "type": { "name": "event_definition", "version": "1" }, "id": "76c56d97-5f21-4dec-8177-34f176fdf5c0", "data": { "field_spec": {}, "config": { "query_parameters": [], "search_within_ms": 600000, "query": { "@type": "string", "@value": "" }, "cron_expression": null, "cron_timezone": null, "use_cron_scheduling": false, "streams": [ "a757b86e-2c34-4fd5-8506-7c1e1a8df45c" ], "execute_every_ms": 60000, "event_limit": 100, "group_by": [ "winlogbeat_winlog_event_data_IpAddress" ], "series": [ { "type": "count", "id": "count-", "field": null } ], "conditions": { "expression": { "expr": ">=", "left": { "expr": "number-ref", "ref": "count-" }, "right": { "expr": "number", "value": 5 } } }, "type": "aggregation-v1", "stream_categories": [], "filters": [] }, "priority": { "@type": "integer", "@value": 3 }, "notifications": [ { "notification_id": { "@type": "string", "@value": "e572286d-dcf2-45b3-b22a-b7d1857e3587" }, "notification_parameters": null } ], "remediation_steps": null, "matched_at": "2026-06-08T04:45:31.349Z", "event_procedure": null, "_scope": { "@type": "string", "@value": "DEFAULT" }, "notification_settings": { "grace_period_ms": 300000, "backlog_size": 5 }, "updated_at": "2026-06-09T00:09:03.564Z", "title": { "@type": "string", "@value": "Windows Auth Failures for Sidecar - Repeated Failures From Same IP" }, "is_scheduled": { "@type": "boolean", "@value": true }, "key_spec": [], "storage": [ { "type": "persist-to-streams-v1", "streams": [ "000000000000000000000002" ] } ], "alert": { "@type": "boolean", "@value": true }, "description": { "@type": "string", "@value": "Detect consecutive authentication failures from the same IP address" } }, "constraints": [ { "type": "server-version", "version": ">=7.0.5+1a1d8ce" } ] }, { "v": "1", "type": { "name": "event_definition", "version": "1" }, "id": "8ca3d585-2cf2-46c8-9ed6-f33dd4f75534", "data": { "field_spec": {}, "config": { "query_parameters": [], "search_within_ms": 300000, "query": { "@type": "string", "@value": "" }, "cron_expression": null, "cron_timezone": null, "use_cron_scheduling": false, "streams": [ "a757b86e-2c34-4fd5-8506-7c1e1a8df45c" ], "execute_every_ms": 60000, "event_limit": 100, "group_by": [], "series": [ { "type": "count", "id": "count-", "field": null } ], "conditions": { "expression": { "expr": ">=", "left": { "expr": "number-ref", "ref": "count-" }, "right": { "expr": "number", "value": 10 } } }, "type": "aggregation-v1", "stream_categories": [], "filters": [] }, "priority": { "@type": "integer", "@value": 3 }, "notifications": [ { "notification_id": { "@type": "string", "@value": "e572286d-dcf2-45b3-b22a-b7d1857e3587" }, "notification_parameters": null } ], "remediation_steps": null, "matched_at": "2026-06-08T04:38:31.978Z", "event_procedure": null, "_scope": { "@type": "string", "@value": "DEFAULT" }, "notification_settings": { "grace_period_ms": 300000, "backlog_size": 5 }, "updated_at": "2026-06-09T00:09:25.874Z", "title": { "@type": "string", "@value": "Windows Auth Failures for Sidecar - Volume Threshold" }, "is_scheduled": { "@type": "boolean", "@value": true }, "key_spec": [], "storage": [ { "type": "persist-to-streams-v1", "streams": [ "000000000000000000000002" ] } ], "alert": { "@type": "boolean", "@value": true }, "description": { "@type": "string", "@value": "Detects more than 10 authentication failures in 5 minutes" } }, "constraints": [ { "type": "server-version", "version": ">=7.0.5+1a1d8ce" } ] }, { "v": "1", "type": { "name": "dashboard", "version": "2" }, "id": "155d74f1-63bb-496b-a49b-514ba9321a55", "data": { "summary": { "@type": "string", "@value": "A dashboard that visualizes authentication failure events in the Windows Security log" }, "search": { "queries": [ { "id": "8a172256-97b5-4602-91c1-c8299aa19e1e", "timerange": { "from": 3600, "type": "relative" }, "filter": { "type": "or", "filters": [ { "type": "stream", "id": "a757b86e-2c34-4fd5-8506-7c1e1a8df45c" } ] }, "filters": [], "query": { "type": "elasticsearch", "query_string": "" }, "search_types": [ { "query": { "type": "elasticsearch", "query_string": "" }, "name": "chart", "timerange": { "from": 3600, "type": "relative" }, "column_limit": null, "streams": [ "a757b86e-2c34-4fd5-8506-7c1e1a8df45c" ], "row_limit": null, "series": [ { "type": "count", "id": "Count", "field": null } ], "filter": null, "rollup": true, "row_groups": [ { "type": "values", "fields": [ "winlogbeat_winlog_event_id" ], "limit": 10, "skip_empty_values": false } ], "type": "pivot", "stream_categories": [], "id": "d4bfffca-6c59-4392-833e-014e2e9da005", "filters": [], "column_groups": [], "sort": [ { "type": "series", "field": "count()", "direction": "Descending" } ] }, { "query": { "type": "elasticsearch", "query_string": "" }, "name": "chart", "timerange": { "from": 3600, "type": "relative" }, "column_limit": null, "streams": [ "a757b86e-2c34-4fd5-8506-7c1e1a8df45c" ], "row_limit": null, "series": [ { "type": "count", "id": "Count", "field": null } ], "filter": null, "rollup": true, "row_groups": [ { "type": "values", "fields": [ "winlogbeat_winlog_event_data_IpAddress" ], "limit": 10, "skip_empty_values": false } ], "type": "pivot", "stream_categories": [], "id": "b880f3dd-fec3-4839-a818-17ab89da8465", "filters": [], "column_groups": [], "sort": [ { "type": "series", "field": "count()", "direction": "Descending" } ] }, { "query": { "type": "elasticsearch", "query_string": "" }, "name": "chart", "timerange": { "from": 3600, "type": "relative" }, "column_limit": null, "streams": [ "a757b86e-2c34-4fd5-8506-7c1e1a8df45c" ], "row_limit": null, "series": [ { "type": "count", "id": "Count", "field": null } ], "filter": null, "rollup": true, "row_groups": [ { "type": "values", "fields": [ "source" ], "limit": 10, "skip_empty_values": false } ], "type": "pivot", "stream_categories": [], "id": "509a55c2-63f2-4cbf-93bd-e18396aafa27", "filters": [], "column_groups": [], "sort": [ { "type": "series", "field": "count()", "direction": "Descending" } ] }, { "query": { "type": "elasticsearch", "query_string": "" }, "name": "chart", "timerange": { "from": 3600, "type": "relative" }, "column_limit": null, "streams": [ "a757b86e-2c34-4fd5-8506-7c1e1a8df45c" ], "row_limit": null, "series": [ { "type": "count", "id": "count()", "field": null } ], "filter": null, "rollup": true, "row_groups": [ { "type": "time", "fields": [ "timestamp" ], "interval": { "type": "auto", "scaling": 1 } } ], "type": "pivot", "stream_categories": [], "id": "8d24e5c4-f6ec-478f-a8c4-a87947d54fe8", "filters": [], "column_groups": [], "sort": [] }, { "query": { "type": "elasticsearch", "query_string": "" }, "name": "chart", "timerange": { "from": 3600, "type": "relative" }, "column_limit": null, "streams": [ "a757b86e-2c34-4fd5-8506-7c1e1a8df45c" ], "row_limit": null, "series": [ { "type": "count", "id": "Count", "field": null } ], "filter": null, "rollup": true, "row_groups": [ { "type": "time", "fields": [ "timestamp" ], "interval": { "type": "timeunit", "timeunit": "1m" } } ], "type": "pivot", "stream_categories": [], "id": "c937ed1c-3ca7-499b-9b0d-7270f7653214", "filters": [], "column_groups": [], "sort": [] }, { "query": { "type": "elasticsearch", "query_string": "" }, "name": null, "timerange": { "from": 3600, "type": "relative" }, "offset": 0, "streams": [ "a757b86e-2c34-4fd5-8506-7c1e1a8df45c" ], "filter": null, "decorators": [], "type": "messages", "stream_categories": [], "id": "864f763d-142f-44bf-8037-99a3cb254b51", "limit": 150, "filters": [] }, { "query": { "type": "elasticsearch", "query_string": "" }, "name": "chart", "timerange": { "from": 3600, "type": "relative" }, "column_limit": null, "streams": [ "a757b86e-2c34-4fd5-8506-7c1e1a8df45c" ], "row_limit": null, "series": [ { "type": "count", "id": "Count", "field": null } ], "filter": null, "rollup": true, "row_groups": [ { "type": "values", "fields": [ "winlogbeat_winlog_event_data_TargetUserName" ], "limit": 10, "skip_empty_values": false } ], "type": "pivot", "stream_categories": [], "id": "a25549ae-95ff-41f3-976b-2dc7be3b65b3", "filters": [], "column_groups": [], "sort": [ { "type": "series", "field": "count()", "direction": "Descending" } ] }, { "query": { "type": "elasticsearch", "query_string": "" }, "name": null, "timerange": { "from": 3600, "type": "relative" }, "offset": 0, "streams": [ "a757b86e-2c34-4fd5-8506-7c1e1a8df45c" ], "filter": null, "decorators": [], "type": "messages", "stream_categories": [], "id": "cea9f671-7f4b-4212-ae91-8bed8708dedd", "limit": 150, "filters": [] } ] } ], "parameters": [], "requires": {}, "owner": "admin", "created_at": "2026-06-08T04:30:18.895Z" }, "created_at": "2026-06-08T04:09:42.645Z", "requires": {}, "state": { "8a172256-97b5-4602-91c1-c8299aa19e1e": { "selected_fields": null, "static_message_list_id": null, "titles": { "widget": { "ffc1a757-2acf-44ec-95cb-5f38dcc409ee": "Top Hosts by Number of Failures", "5bcd6200-b49d-46f2-b527-1448d9f82a6b": "Top Users by Number of Failures", "a723a3ef-5585-41e1-804f-09601899da70": "Breakdown of authentication failure types", "2fbfae27-a724-48b0-9630-0f6a7d27d15f": "Recent authentication failure events", "05fef793-0d95-4bab-b13c-52267ea3f382": "Top Users by Number of Failures", "4aaaf44a-294b-414a-a792-7567551eefc8": "Message Count", "d2fafd36-4bf5-437c-a9fc-89b919bcf09e": "All Messages", "50002758-9988-402f-85e3-a7161e85eac1": "Top IP Addresses by Number of Failures", "388dcde5-ef70-4a9a-9ca5-f856f15ec6db": "Trend in the Number of Authentication Failures" } }, "widgets": [ { "config": { "fields": [ "timestamp", "source", "winlogbeat_winlog_event_id", "winlogbeat_winlog_event_data_TargetUserName", "winlogbeat_winlog_event_data_IpAddress" ], "units": {}, "show_message_row": true, "show_summary": true, "decorators": [], "sort": [ { "type": "pivot", "field": "timestamp", "direction": "Descending" } ] }, "query": { "type": "elasticsearch", "query_string": "" }, "context": null, "timerange": { "from": 3600, "type": "relative" }, "streams": [ "a757b86e-2c34-4fd5-8506-7c1e1a8df45c" ], "filter": null, "type": "messages", "stream_categories": [], "id": "2fbfae27-a724-48b0-9630-0f6a7d27d15f", "filters": [], "description": null }, { "config": { "visualization": "table", "units": {}, "column_limit": null, "event_annotation": false, "row_limit": 10, "row_pivots": [ { "fields": [ "source" ], "type": "values", "config": { "limit": 10 } } ], "series": [ { "config": { "name": "Count", "thresholds": [] }, "function": "count()" } ], "rollup": false, "column_pivots": [], "visualization_config": { "pinned_columns": [], "show_row_numbers": true }, "formatting_settings": null, "sort": [ { "type": "series", "field": "count()", "direction": "Descending" } ] }, "query": { "type": "elasticsearch", "query_string": "" }, "context": null, "timerange": { "from": 3600, "type": "relative" }, "streams": [ "a757b86e-2c34-4fd5-8506-7c1e1a8df45c" ], "filter": null, "type": "aggregation", "stream_categories": [], "id": "ffc1a757-2acf-44ec-95cb-5f38dcc409ee", "filters": [], "description": null }, { "config": { "visualization": "pie", "units": {}, "column_limit": null, "event_annotation": false, "row_limit": 10, "row_pivots": [ { "fields": [ "winlogbeat_winlog_event_id" ], "type": "values", "config": { "limit": 10 } } ], "series": [ { "config": { "name": "Count", "thresholds": [] }, "function": "count()" } ], "rollup": false, "column_pivots": [], "visualization_config": null, "formatting_settings": null, "sort": [ { "type": "series", "field": "count()", "direction": "Descending" } ] }, "query": { "type": "elasticsearch", "query_string": "" }, "context": null, "timerange": { "from": 3600, "type": "relative" }, "streams": [ "a757b86e-2c34-4fd5-8506-7c1e1a8df45c" ], "filter": null, "type": "aggregation", "stream_categories": [], "id": "a723a3ef-5585-41e1-804f-09601899da70", "filters": [], "description": null }, { "config": { "visualization": "bar", "units": {}, "column_limit": null, "event_annotation": false, "row_limit": null, "row_pivots": [ { "fields": [ "timestamp" ], "type": "time", "config": { "interval": { "type": "timeunit", "value": 1, "unit": "minutes" } } } ], "series": [ { "config": { "name": "Count", "thresholds": [] }, "function": "count()" } ], "rollup": false, "column_pivots": [], "visualization_config": { "barmode": "group", "axis_type": "linear" }, "formatting_settings": null, "sort": [] }, "query": { "type": "elasticsearch", "query_string": "" }, "context": null, "timerange": { "from": 3600, "type": "relative" }, "streams": [ "a757b86e-2c34-4fd5-8506-7c1e1a8df45c" ], "filter": null, "type": "aggregation", "stream_categories": [], "id": "388dcde5-ef70-4a9a-9ca5-f856f15ec6db", "filters": [], "description": null }, { "config": { "fields": [ "timestamp", "source" ], "units": {}, "show_message_row": true, "show_summary": true, "decorators": [], "sort": [ { "type": "pivot", "field": "timestamp", "direction": "Descending" } ] }, "query": { "type": "elasticsearch", "query_string": "" }, "context": null, "timerange": { "from": 3600, "type": "relative" }, "streams": [ "a757b86e-2c34-4fd5-8506-7c1e1a8df45c" ], "filter": null, "type": "messages", "stream_categories": [], "id": "d2fafd36-4bf5-437c-a9fc-89b919bcf09e", "filters": [], "description": null }, { "config": { "visualization": "table", "units": {}, "column_limit": null, "event_annotation": false, "row_limit": 10, "row_pivots": [ { "fields": [ "winlogbeat_winlog_event_data_IpAddress" ], "type": "values", "config": { "limit": 10 } } ], "series": [ { "config": { "name": "Count", "thresholds": [] }, "function": "count()" } ], "rollup": false, "column_pivots": [], "visualization_config": { "pinned_columns": [], "show_row_numbers": true }, "formatting_settings": null, "sort": [ { "type": "series", "field": "count()", "direction": "Descending" } ] }, "query": { "type": "elasticsearch", "query_string": "" }, "context": null, "timerange": { "from": 3600, "type": "relative" }, "streams": [ "a757b86e-2c34-4fd5-8506-7c1e1a8df45c" ], "filter": null, "type": "aggregation", "stream_categories": [], "id": "50002758-9988-402f-85e3-a7161e85eac1", "filters": [], "description": null }, { "config": { "visualization": "table", "units": {}, "column_limit": null, "event_annotation": false, "row_limit": 10, "row_pivots": [ { "fields": [ "winlogbeat_winlog_event_data_TargetUserName" ], "type": "values", "config": { "limit": 10 } } ], "series": [ { "config": { "name": "Count", "thresholds": [] }, "function": "count()" } ], "rollup": false, "column_pivots": [], "visualization_config": { "pinned_columns": [], "show_row_numbers": true }, "formatting_settings": null, "sort": [ { "type": "series", "field": "count()", "direction": "Descending" } ] }, "query": { "type": "elasticsearch", "query_string": "" }, "context": null, "timerange": { "from": 3600, "type": "relative" }, "streams": [ "a757b86e-2c34-4fd5-8506-7c1e1a8df45c" ], "filter": null, "type": "aggregation", "stream_categories": [], "id": "5bcd6200-b49d-46f2-b527-1448d9f82a6b", "filters": [], "description": null }, { "config": { "visualization": "bar", "units": {}, "column_limit": null, "event_annotation": false, "row_limit": null, "row_pivots": [ { "fields": [ "timestamp" ], "type": "time", "config": { "interval": { "type": "auto", "scaling": 1 } } } ], "series": [ { "config": { "name": null, "thresholds": [] }, "function": "count()" } ], "rollup": true, "column_pivots": [], "visualization_config": null, "formatting_settings": null, "sort": [] }, "query": { "type": "elasticsearch", "query_string": "" }, "context": null, "timerange": { "from": 3600, "type": "relative" }, "streams": [ "a757b86e-2c34-4fd5-8506-7c1e1a8df45c" ], "filter": null, "type": "aggregation", "stream_categories": [], "id": "4aaaf44a-294b-414a-a792-7567551eefc8", "filters": [], "description": null } ], "widget_mapping": { "4aaaf44a-294b-414a-a792-7567551eefc8": [ "8d24e5c4-f6ec-478f-a8c4-a87947d54fe8" ], "50002758-9988-402f-85e3-a7161e85eac1": [ "b880f3dd-fec3-4839-a818-17ab89da8465" ], "ffc1a757-2acf-44ec-95cb-5f38dcc409ee": [ "509a55c2-63f2-4cbf-93bd-e18396aafa27" ], "a723a3ef-5585-41e1-804f-09601899da70": [ "d4bfffca-6c59-4392-833e-014e2e9da005" ], "d2fafd36-4bf5-437c-a9fc-89b919bcf09e": [ "cea9f671-7f4b-4212-ae91-8bed8708dedd" ], "388dcde5-ef70-4a9a-9ca5-f856f15ec6db": [ "c937ed1c-3ca7-499b-9b0d-7270f7653214" ], "5bcd6200-b49d-46f2-b527-1448d9f82a6b": [ "a25549ae-95ff-41f3-976b-2dc7be3b65b3" ], "2fbfae27-a724-48b0-9630-0f6a7d27d15f": [ "864f763d-142f-44bf-8037-99a3cb254b51" ] }, "positions": { "5bcd6200-b49d-46f2-b527-1448d9f82a6b": { "col": 1, "row": 8, "height": 4, "width": 4 }, "ffc1a757-2acf-44ec-95cb-5f38dcc409ee": { "col": 9, "row": 8, "height": 4, "width": 4 }, "a723a3ef-5585-41e1-804f-09601899da70": { "col": 5, "row": 12, "height": 4, "width": 4 }, "2fbfae27-a724-48b0-9630-0f6a7d27d15f": { "col": 1, "row": 3, "height": 5, "width": "Infinity" }, "4aaaf44a-294b-414a-a792-7567551eefc8": { "col": 1, "row": 1, "height": 2, "width": "Infinity" }, "50002758-9988-402f-85e3-a7161e85eac1": { "col": 5, "row": 8, "height": 4, "width": 4 }, "d2fafd36-4bf5-437c-a9fc-89b919bcf09e": { "col": 1, "row": 16, "height": 6, "width": "Infinity" }, "388dcde5-ef70-4a9a-9ca5-f856f15ec6db": { "col": 1, "row": 12, "height": 4, "width": 4 } }, "formatting": { "highlighting": [] }, "display_mode_settings": { "positions": {} } } }, "properties": [], "owner": "admin", "title": { "@type": "string", "@value": "Windows Authentication Failures Overview for Sidecar" }, "type": "DASHBOARD", "description": { "@type": "string", "@value": "A monitoring dashboard that displays trends in the number of authentication failures, top users, top source IP addresses, top hosts, a breakdown by type, and a list of recent events for Event IDs 4625, 4771, and 4776." } }, "constraints": [ { "type": "server-version", "version": ">=7.0.5+1a1d8ce" } ] }, { "v": "1", "type": { "name": "notification", "version": "1" }, "id": "e572286d-dcf2-45b3-b22a-b7d1857e3587", "data": { "title": { "@type": "string", "@value": "Notify - Windows Auth Failure - Email" }, "description": { "@type": "string", "@value": "Email Notifications for Monitoring Windows Authentication Failures" }, "config": { "bcc_emails_lut_key": { "@type": "string", "@value": "" }, "sender_lut_key": { "@type": "string", "@value": "" }, "lookup_recipient_emails": { "@type": "boolean", "@value": false }, "cc_emails_lut_key": { "@type": "string", "@value": "" }, "html_body_template": { "@type": "string", "@value": "\n \n

Graylog Alert

\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n Overview\n
Rule${event_definition_title}
Description${event_definition_description}
Timestamp${event.timestamp}
Priority${event.priority}
\n\n
\n
\n Summary\n
\n
\n ${event.message}\n
\n
\n\n ${if backlog}\n
\n
\n Backlog\n
\n
\n \n
\n
\n ${end}\n \n" }, "recipients_lut_name": { "@type": "string", "@value": "" }, "single_email": { "@type": "boolean", "@value": false }, "replyTo": { "@type": "string", "@value": "" }, "recipients_lut_key": { "@type": "string", "@value": "" }, "cc_emails_lut_name": { "@type": "string", "@value": "" }, "sender_lut_name": { "@type": "string", "@value": "" }, "cc_users": [], "bcc_emails_lut_name": { "@type": "string", "@value": "" }, "bcc_users": [], "subject": { "@type": "string", "@value": "Graylog Alert: ${event_definition_title}" }, "reply_to_lut_name": { "@type": "string", "@value": "" }, "user_recipients": [], "lookup_cc_emails": { "@type": "boolean", "@value": false }, "lookup_reply_to_email": { "@type": "boolean", "@value": false }, "bcc_emails": [], "sender": { "@type": "string", "@value": "" }, "cc_emails": [], "body_template": { "@type": "string", "@value": "[Graylog Alert]\n\n[Overview]\n- Rule: ${event_definition_title}\n- Description: ${event_definition_description}\n- Timestamp: ${event.timestamp}\n- Priority: ${event.priority}\n\n[Summary]\n${event.message}\n\n${if backlog}\n[Backlog]\n${foreach backlog message}\n- ${message}\n${end}\n${end}" }, "lookup_sender_email": { "@type": "boolean", "@value": false }, "lookup_bcc_emails": { "@type": "boolean", "@value": false }, "type": "email-notification-v1", "include_event_procedures": { "@type": "boolean", "@value": false }, "reply_to_lut_key": { "@type": "string", "@value": "" }, "email_recipients": [ "admin@example.com" ], "time_zone": { "@type": "string", "@value": "Asia/Tokyo" } } }, "constraints": [ { "type": "server-version", "version": ">=7.0.5+1a1d8ce" } ] }, { "v": "1", "type": { "name": "sidecar_collector", "version": "1" }, "id": "08229417-d334-40c8-b35e-5a78d1a69afa", "data": { "name": { "@type": "string", "@value": "winlogbeat" }, "service_type": { "@type": "string", "@value": "svc" }, "node_operating_system": { "@type": "string", "@value": "windows" }, "executable_path": { "@type": "string", "@value": "C:\\Program Files\\Graylog\\sidecar\\winlogbeat.exe" }, "execute_parameters": { "@type": "string", "@value": "-c \"%s\"" }, "validation_parameters": { "@type": "string", "@value": "test config -c \"%s\"" }, "default_template": { "@type": "string", "@value": "# Required settings\nfields_under_root: true\nfields.collector_node_id: ${sidecar.nodeName}\nfields.gl2_source_collector: ${sidecar.nodeId}\n\n\noutput.logstash:\n hosts: [\"${user.graylog_host}:5044\"]\npath:\n data: ${sidecar.spoolDir!\"C:\\\\Program Files\\\\Graylog\\\\sidecar\\\\cache\\\\winlogbeat\"}\\data\n logs: ${sidecar.spoolDir!\"C:\\\\Program Files\\\\Graylog\\\\sidecar\"}\\logs\ntags:\n - windows\nwinlogbeat:\n event_logs:\n - name: Application\n ignore_older: 96h\n - name: System\n ignore_older: 96h\n - name: Security\n ignore_older: 96h\n - name: Setup\n ignore_older: 96h\n - name: ForwardedEvents\n forwarded: true\n ignore_older: 96h\n - name: Microsoft-Windows-Windows Defender/Operational\n ignore_older: 96h\n - name: Microsoft-Windows-Sysmon/Operational\n ignore_older: 96h\n - name: Microsoft-Windows-TerminalServices-LocalSessionManager/Operational\n ignore_older: 96h\n - name: Microsoft-Windows-PowerShell/Operational\n ignore_older: 96h\n - name: windows PowerShell\n ignore_older: 96h" } }, "constraints": [ { "type": "server-version", "version": ">=7.0.5+1a1d8ce" } ] } ] }