WatchAD攻防实战

## WatchAD攻防实战 WatchAD是0KEE Team研发的开源域安全入侵感知系统,WatchAD收集所有域控上的事件日志和kerberos流量,通过特征匹配、Kerberos协议分析、历史行为、敏感操作和蜜罐账户等...
  • 发表于 2021-10-15 14:10:31
  • 阅读 ( 5910 )
  • 分类:安全工具

2 条评论

General
4.启动winlogbeat .\winlogbeat.exe –e -c .\winlogbeat.yml 出现successfully published字样,基本就成功了 问一下 我这里启动有点问题 PS C:\Program Files\Winlogbeat> .\winlogbeat.exe -e -c .\winlogbeat.yml 2022-06-10T09:20:38.713+0800 INFO instance/beat.go:468 Home path: [C:\Program Files\Winlogbeat] Config path: [C:\Program Files\Winlogbeat] Data path: [C:\Program Files\Winlogbeat\data] Logs path: [C:\Program Files\Winlogbeat\logs] 2022-06-10T09:20:38.731+0800 INFO instance/beat.go:475 Beat UUID: 1d6869eb-9bc0-4a6d-85f5-f5759653e6ed 2022-06-10T09:20:38.733+0800 INFO instance/beat.go:213 Setup Beat: winlogbeat; Version: 6.2.0 2022-06-10T09:20:38.735+0800 WARN instance/metrics_other.go:8 Metrics not implemented for this OS. 2022-06-10T09:20:38.752+0800 INFO pipeline/module.go:76 Beat name: WIN-SRMTER94UPR 2022-06-10T09:20:38.754+0800 INFO beater/winlogbeat.go:56 State will be read from and persisted to C:\Program Files\Winlogbeat\data\.winlogbeat.yml 2022-06-10T09:20:38.758+0800 INFO instance/beat.go:301 winlogbeat start running. 2022-06-10T09:20:38.764+0800 INFO [monitoring] log/log.go:97 Starting metrics logging every 30s 2022-06-10T09:20:42.854+0800 ERROR pipeline/output.go:74 Failed to connect: dial tcp 10.10.10.12:5044: connectex: No connection could be made because the target machine actively refused it. 2022-06-10T09:20:45.884+0800 ERROR pipeline/output.go:74 Failed to connect: dial tcp 10.10.10.12:5044: connectex: No connection could be made because the target machine actively refused it. 2022-06-10T09:20:50.908+0800 ERROR pipeline/output.go:74 Failed to connect: dial tcp 10.10.10.12:5044: connectex: No connection could be made because the target machine actively refused it. 2022-06-10T09:20:59.932+0800 ERROR pipeline/output.go:74 Failed to connect: dial tcp 10.10.10.12:5044: connectex: No connection could be made because the target machine actively refused it. 2022-06-10T09:21:08.777+0800 INFO [monitoring] log/log.go:124 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"libbeat":{"config":{"module":{"running":0}},"output":{"type":"logstash"},"pipeline":{"clients":1,"events":{"active":4117,"published":4116,"retry":3600,"total":4117}}},"msg_file_cache":{"SecurityHits":4202,"SecurityMisses":1,"SecuritySize":1},"uptime":"{\"server_time\":\"2022-06-10T01:21:08.7727189Z\",\"start_time\":\"2022-06-10T01:20:38.7052249Z\",\"uptime\":\"30.067494s\",\"uptime_ms\":\"30067494\"}"}}} 2022-06-10T09:21:16.995+0800 ERROR pipeline/output.go:74 Failed to connect: dial tcp 10.10.10.12:5044: connectex: No connection could be made because the target machine actively refused it. 2022-06-10T09:21:38.777+0800 INFO [monitoring] log/log.go:124 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":1,"events":{"active":4117,"retry":900}}},"uptime":"{\"server_time\":\"2022-06-10T01:21:38.7773897Z\",\"start_time\":\"2022-06-10T01:20:38.7052249Z\",\"uptime\":\"1m0.0721648s\",\"uptime_ms\":\"60072164\"}"}}} 2022-06-10T09:21:50.023+0800 ERROR pipeline/output.go:74 Failed to connect: dial tcp 10.10.10.12:5044: connectex: No connection could be made because the target machine actively refused it. 2022-06-10T09:22:08.778+0800 INFO [monitoring] log/log.go:124 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":1,"events":{"active":4117,"retry":1800}}},"uptime":"{\"server_time\":\"2022-06-10T01:22:08.7781495Z\",\"start_time\":\"2022-06-10T01:20:38.7052249Z\",\"uptime\":\"1m30.0729246s\",\"uptime_ms\":\"90072924\"}"}}} 还请帮看看哪里的问题 ?
请先 登录 后评论
General
进行初始化安装 python3 WatchAD.py --install -d Motoo.nc -s 192.168.159.149 -u motoo\\administrator -p Motoo123\!\@\#45 这里连接也有问题 [root@localhost /]# cd /root/WatchAD/ [root@localhost WatchAD]# python3 WatchAD.py --install -d general.local -s 10.10.10.10 -u general\\administrator -p Ds@902903 Traceback (most recent call last): File "WatchAD.py", line 21, in from scripts.init_settings import init_es_template, check_es_template, check_mongo_connection, check_mq_connection, \ File "/root/WatchAD/scripts/init_settings.py", line 8, in import simplejson ModuleNotFoundError: No module named 'simplejson'
请先 登录 后评论
请先 登录 后评论
tinyfisher
tinyfisher

1 篇文章