input {
  beats {
    port => 5044
    tags => ["windows-security", "sysmon"]
  }
}

filter {
  # ========== Windows Security Event の標準化 ==========
  if [winlog] {
    mutate {
      rename => { "[winlog][event_id]" => "event.code" }
      rename => { "[winlog][computer_name]" => "host.name" }
      rename => { "[winlog][event_data][TargetUserName]" => "user.target" }
      rename => { "[winlog][event_data][SubjectUserName]" => "user.source" }
      rename => { "[winlog][event_data][ComputerName]" => "source.computer" }
      rename => { "[winlog][event_data][IpAddress]" => "source.ip" }
      rename => { "[winlog][event_data][WorkstationName]" => "source.workstation" }
    }
  }
  
  # ========== Sysmon イベント（Event ID 1-25）の標準化 ==========
  if [winlog][provider_name] == "Microsoft-Windows-Sysmon" or [event][provider] == "Sysmon" {
    
    # Event ID 1: Process Creation
    if [event][code] == 1 {
      mutate {
        rename => { "[winlog][event_data][ProcessGuid]" => "process.guid" }
        rename => { "[winlog][event_data][ProcessId]" => "process.pid" }
        rename => { "[winlog][event_data][Image]" => "process.name" }
        rename => { "[winlog][event_data][CommandLine]" => "process.command_line" }
        rename => { "[winlog][event_data][ParentProcessId]" => "process.parent.pid" }
        rename => { "[winlog][event_data][ParentImage]" => "process.parent.name" }
        rename => { "[winlog][event_data][User]" => "process.user" }
      }
      # 基本的なプロセス異常検知
      if [process][name] =~ /(cmd\.exe|powershell\.exe|cscript\.exe|wscript\.exe)/ {
        mutate {
          add_field => { "threat.detection.type" => "suspicious_interpreter" }
        }
      }
    }
    
    # Event ID 3: Network Connection
    if [event][code] == 3 {
      mutate {
        rename => { "[winlog][event_data][ProcessId]" => "process.pid" }
        rename => { "[winlog][event_data][Image]" => "process.name" }
        rename => { "[winlog][event_data][SourceIp]" => "source.ip" }
        rename => { "[winlog][event_data][SourcePort]" => "source.port" }
        rename => { "[winlog][event_data][DestinationIp]" => "destination.ip" }
        rename => { "[winlog][event_data][DestinationPort]" => "destination.port" }
        rename => { "[winlog][event_data][Protocol]" => "network.protocol" }
        rename => { "[winlog][event_data][InitiatedConnection]" => "network.direction" }
      }
    }
    
    # Event ID 7: DLL Load
    if [event][code] == 7 {
      mutate {
        rename => { "[winlog][event_data][ProcessId]" => "process.pid" }
        rename => { "[winlog][event_data][Image]" => "process.name" }
        rename => { "[winlog][event_data][ImageLoaded]" => "file.name" }
      }
    }
    
    # Event ID 10: Process Access (LSASS ダンプ検知)
    if [event][code] == 10 {
      mutate {
        rename => { "[winlog][event_data][SourceProcessId]" => "process.source.pid" }
        rename => { "[winlog][event_data][SourceImage]" => "process.source.name" }
        rename => { "[winlog][event_data][TargetProcessId]" => "process.target.pid" }
        rename => { "[winlog][event_data][TargetImage]" => "process.target.name" }
        rename => { "[winlog][event_data][GrantedAccess]" => "process.access.granted" }
      }
      # LSASS アクセス検知
      if [process][target][name] =~ /lsass\.exe/ {
        mutate {
          add_field => { "threat.detection.type" => "credential_access" }
          add_field => { "threat.severity" => "critical" }
        }
      }
    }
    
    # Event ID 13: Registry Event (永続化検知)
    if [event][code] == 13 {
      mutate {
        rename => { "[winlog][event_data][ProcessId]" => "process.pid" }
        rename => { "[winlog][event_data][TargetObject]" => "registry.path" }
        rename => { "[winlog][event_data][Details]" => "registry.value" }
      }
      # 危険なレジストリパス検知
      if [registry][path] =~ /(HKLM.*Run|HKLM.*Services|HKLM.*LSA)/ {
        mutate {
          add_field => { "threat.detection.type" => "persistence" }
        }
      }
    }
    
    # Event ID 17/18: Named Pipe Event
    if [event][code] in [17, 18] {
      mutate {
        rename => { "[winlog][event_data][ProcessId]" => "process.pid" }
        rename => { "[winlog][event_data][PipeName]" => "pipe.name" }
      }
      # 悪意あるパイプ名検知（Cobalt Strike など）
      if [pipe][name] =~ /(\\\\\\.\\pipe\\.*chrome.*|postex.*|msagent)/ {
        mutate {
          add_field => { "threat.detection.type" => "c2_communication" }
        }
      }
    }
    
    # Event ID 22: DNS Query
    if [event][code] == 22 {
      mutate {
        rename => { "[winlog][event_data][ProcessId]" => "process.pid" }
        rename => { "[winlog][event_data][QueryName]" => "dns.question.name" }
        rename => { "[winlog][event_data][QueryStatus]" => "dns.response_code" }
      }
    }
  }
}

output {
  elasticsearch {
    hosts => ["https://localhost:9200"]
    index => "windows-security-%{+YYYY.MM.dd}"
    user => "${ES_USER}"
    password => "${ES_PASSWORD}"
  }
}

Kibana Correlation Search
query.bool.must:
  - event.code: 10
    process.target.name: lsass.exe
  - time_range: now-5m
correlate_with:
  - event.code: 3
    destination.port: 445
    time_offset: +30s
  - event.code: 4625
    event.code: 4624
    time_offset: +2m

プロンプト:
"ドメインコントローラで Event ID 4769 が大量に発生している。
同時にクライアントの Sysmon で Event ID 1 (cmd.exe/powershell.exe の実行) と 
Event ID 10 (LSASS.exe へのアクセス) が検知されています。
これらを関連付ける Elasticsearch クエリと Kibana ダッシュボード設計を教えて"

応答:
1. 時間窓 5 分以内の Event ID 4769 と Sysmon Event ID 10 を相関させる DSL
2. Timeline ダッシュボード: Event 4769 の発生時刻 ± 2 分に Sysmon Event 10 があるかを確認
3. Alert 設定: 同一ユーザーで上記パターンが検知された場合の通知

プロンプト:
"クライアントで Sysmon Event 10 (LSASS.exe アクセス) が検知された直後に、
Sysmon Event 3 で SMB (445) への接続が記録され、
その 2 分後に DC で Event ID 4625 (NTLM 認証失敗) と Event ID 4624 (成功) が短時間に連続している。
これが Pass-the-Hash 攻撃か検証したい"

応答:
1. 多段階相関クエリ: Sysmon Event 10 → Event 3 (445) → Event 4625 + 4624 の時系列
2. Kibana Correlation Detection: 上記パターンが検知されたら即座に Alert
3. 追加調査: ソースプロセス、ターゲットユーザー、接続先ホストの詳細

プロンプト:
"Sysmon Event ID 13 (Registry Modification) で、
HKLM\Software\Microsoft\Windows\CurrentVersion\Run に 
疑わしいプロセス名が追加されているのを検知したい。
どのような Elasticsearch クエリとダッシュボード設計が最適ですか？"

応答:
1. Event ID 13 + レジストリパス フィルタリング Elasticsearch DSL
2. Kibana テーブル: registry.path, registry.value, process.name を表示
3. Alert ルール: HKLM\.*Run への変更が検知された場合の通知

プロンプト:
"クライアント側の Sysmon Event ID 3 で、
複数のホストへ SMB (445) または RDP (3389) への接続が検知されています。
これが横展開（Lateral Movement）か検証し、
攻撃チェーンを可視化したいです"

応答:
1. Elasticsearch: Sysmon Event 3 で destination.port in [445, 3389] かつ複数ホストへの接続
2. Kibana ネットワーク図: ソースホスト → 複数の接続先ホストの可視化
3. Timeline: 時系列でどのホストに いつ接続したかを追跡

input {
  beats {
    port => 5044
  }
}

filter {
  if [type] == "wineventlog" {
    mutate {
      rename => { "[winlog][event_id]" => "event_id" }
      rename => { "[winlog][computer_name]" => "computer" }
      rename => { "[winlog][event_data][TargetUserName]" => "target_user" }
      rename => { "[winlog][event_data][ComputerName]" => "source_computer" }
      rename => { "[winlog][event_data][IpAddress]" => "source_ip" }
    }
  }
}

output {
  elasticsearch {
    hosts => ["https://localhost:9200"]
    index => "windows-security-%{+YYYY.MM.dd}"
    user => "${ES_USER}"
    password => "${ES_PASSWORD}"
  }
}