CSEC_PUBLIC/WELA
1
0 Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2026-10-01 12:04:46 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
dev
WELA/config/eventlog_profiles.json
T

384 lines
14 KiB
JSON
Raw Permalink Blame History

{
"schemaVersion": 1,
"sources": {
"wela": {
"title": "WELA 2.2.0 logging choices",
"url": "https://github.com/Yamato-Security/WELA/issues/379"
},
"cis-v4": {
"title": "CIS Windows 11 Enterprise / Windows Server 2022 v4.0.0 (historical reviewed editions)",
"url": "https://www.cisecurity.org/benchmark/microsoft_windows_desktop",
"note": "Event Log Service size and full-log behavior recommendations only; effective local values do not establish configured GPO or full benchmark compliance."
},
"asd-2021": {
"title": "ASD Windows event logging and forwarding, October 2021",
"url": "https://www.cyber.gov.au/business-government/detecting-responding-to-threats/event-logging/windows-event-logging-and-forwarding"
},
"ms-wevtutil": {
"title": "Microsoft wevtutil reference",
"url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil"
}
},
"profiles": [
{
"id": "wela-source-2.2.0",
"kind": "source",
"scope": "event-log-size-and-mode-only",
"note": "Default configure/audit-filesize model. Circular mode is a recommendation; applying it requires -ApplyLogMode. Sizes are minima unless -ResizeLogs is explicit.",
"controls": [
{
"log": "Application",
"minimumBytes": 134217728,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "Microsoft-Windows-AppLocker/EXE and DLL",
"minimumBytes": 268435456,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "Microsoft-Windows-AppLocker/MSI and Script",
"minimumBytes": 268435456,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "Microsoft-Windows-AppLocker/Packaged app-Deployment",
"minimumBytes": 268435456,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "Microsoft-Windows-AppLocker/Packaged app-Execution",
"minimumBytes": 268435456,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "Microsoft-Windows-Bits-Client/Analytic",
"minimumBytes": 134217728,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "Microsoft-Windows-Bits-Client/Operational",
"minimumBytes": 134217728,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "Microsoft-Windows-CodeIntegrity/Operational",
"minimumBytes": 134217728,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "Microsoft-Windows-Crypto-DPAPI/Debug",
"minimumBytes": 134217728,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "Microsoft-Windows-DFSN-Server/Admin",
"minimumBytes": 134217728,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
"minimumBytes": 134217728,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "Microsoft-Windows-NTLM/Operational",
"minimumBytes": 134217728,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "Microsoft-Windows-PowerShell/Operational",
"minimumBytes": 1073741824,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "Microsoft-Windows-PrintService/Admin",
"minimumBytes": 134217728,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "Microsoft-Windows-PrintService/Operational",
"minimumBytes": 134217728,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "Microsoft-Windows-Security-Mitigations/KernelMode",
"minimumBytes": 134217728,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "Microsoft-Windows-Security-Mitigations/UserMode",
"minimumBytes": 134217728,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "Microsoft-Windows-SmbClient/Security",
"minimumBytes": 134217728,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "Microsoft-Windows-TaskScheduler/Operational",
"minimumBytes": 134217728,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational",
"minimumBytes": 134217728,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "Microsoft-Windows-Windows Defender/Operational",
"minimumBytes": 134217728,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall",
"minimumBytes": 268435456,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "Microsoft-Windows-WMI-Activity/Operational",
"minimumBytes": 134217728,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "Security",
"minimumBytes": 1073741824,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "System",
"minimumBytes": 134217728,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "Windows PowerShell",
"minimumBytes": 1073741824,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "WELA 2.2.0 shared size model; preserves prior configure 1024 MiB thresholds and fixes audit/configure mismatches."
},
{
"log": "Setup",
"minimumBytes": 33554432,
"mode": "Circular",
"sourceIds": [
"cis-v4"
],
"evidence": "CIS v4.0.0 18.10.26.3.2: Setup >=32768 KiB; Windows 11 p.1047, Server 2022 p.849."
},
{
"log": "Microsoft-Windows-Diagnosis-Scripted/Operational",
"minimumBytes": 134217728,
"mode": "Circular",
"sourceIds": [
"wela"
],
"evidence": "Retains the prior WELA configure 128 MiB setting; now shared with size auditing."
}
]
},
{
"id": "cis-v4-source",
"kind": "source",
"scope": "event-log-size-and-mode-only",
"note": "Reviewed Windows 11 Enterprise and Server 2022 v4.0.0 effective log settings only; not a GPO compliance assessment.",
"controls": [
{
"log": "Application",
"minimumBytes": 33554432,
"mode": "Circular",
"sourceIds": [
"cis-v4"
],
"evidence": "Client v4.0.0 18.10.26.1.1 p.1035; Client v4.0.0 18.10.26.1.2 p.1037; Server v4.0.0 18.10.26.1.1 p.837; Server v4.0.0 18.10.26.1.2 p.839. Size minimum; full-log retention Disabled (overwrite)."
},
{
"log": "Security",
"minimumBytes": 201326592,
"mode": "Circular",
"sourceIds": [
"cis-v4"
],
"evidence": "Client v4.0.0 18.10.26.2.1 p.1040; Client v4.0.0 18.10.26.2.2 p.1042; Server v4.0.0 18.10.26.2.1 p.842; Server v4.0.0 18.10.26.2.2 p.844. Size minimum; full-log retention Disabled (overwrite)."
},
{
"log": "Setup",
"minimumBytes": 33554432,
"mode": "Circular",
"sourceIds": [
"cis-v4"
],
"evidence": "Client v4.0.0 18.10.26.3.1 p.1045; Client v4.0.0 18.10.26.3.2 p.1047; Server v4.0.0 18.10.26.3.1 p.847; Server v4.0.0 18.10.26.3.2 p.849. Size minimum; full-log retention Disabled (overwrite)."
},
{
"log": "System",
"minimumBytes": 33554432,
"mode": "Circular",
"sourceIds": [
"cis-v4"
],
"evidence": "Client v4.0.0 18.10.26.4.1 p.1050; Client v4.0.0 18.10.26.4.2 p.1052; Server v4.0.0 18.10.26.4.1 p.852; Server v4.0.0 18.10.26.4.2 p.854. Size minimum; full-log retention Disabled (overwrite)."
}
]
},
{
"id": "asd-source-2021-10",
"kind": "source",
"scope": "event-log-size-and-mode-only",
"note": "ASD source buffer sizes. Circular mode is an explicit WELA source-host operating choice; ASD collector archival is a separate profile.",
"controls": [
{
"log": "Application",
"minimumBytes": 67108864,
"mode": "Circular",
"sourceIds": [
"asd-2021",
"wela"
],
"evidence": "ASD source size: Security 2097152 KiB; Application/System 65536 KiB. Circular source mode is a WELA operating choice."
},
{
"log": "Security",
"minimumBytes": 2147483648,
"mode": "Circular",
"sourceIds": [
"asd-2021",
"wela"
],
"evidence": "ASD source size: Security 2097152 KiB; Application/System 65536 KiB. Circular source mode is a WELA operating choice."
},
{
"log": "System",
"minimumBytes": 67108864,
"mode": "Circular",
"sourceIds": [
"asd-2021",
"wela"
],
"evidence": "ASD source size: Security 2097152 KiB; Application/System 65536 KiB. Circular source mode is a WELA operating choice."
}
]
},
{
"id": "asd-collector-archive-2021-10",
"kind": "collector",
"scope": "event-log-size-and-mode-only",
"note": "ForwardedEvents only. Requires a provisioned collector, secure archive storage, capacity monitoring and backup/move procedures. Does not create WEF subscriptions or guarantee retention duration.",
"controls": [
{
"log": "ForwardedEvents",
"minimumBytes": 2147483648,
"mode": "AutoBackup",
"sourceIds": [
"asd-2021"
],
"evidence": "ASD collection server: 2097152 KiB; archive when full when not forwarding to a secure central logging facility."
}
]
}
]
}
Reference in new issue View Git Blame Copy Permalink