Script to install winlogbeat

urls=[]

ipaddr="localhost"#ipaddr

import ctypes

import re

import time

import socket

import _winreg

import platform

import shutil

import ssl

import urllib2

import getpass

import zipfile

import shutil

import os

import glob

from subprocess import PIPE,Popen

import ctypes

class disable_file_system_redirection:

    _disable = ctypes.windll.kernel32.Wow64DisableWow64FsRedirection

    _revert = ctypes.windll.kernel32.Wow64RevertWow64FsRedirection

    def __enter__(self):

        self.old_value = ctypes.c_long()

        self.success = self._disable(ctypes.byref(self.old_value))

    def __exit__(self, type, value, traceback):

        if self.success:

            self._revert(self.old_value)

start=time.time()

os_arch=os.popen("wmic os get osarchitecture").read().split()[-1]

if "32" in os_arch:

    url32="https://script-downloads.comodo.com/sysmon_winlogbeat/winlogbeat/winlogbeat-7.14.0-windows-x86.zip"

    urls.append(url32)

else:

    url64="https://script-downloads.comodo.com/sysmon_winlogbeat/winlogbeat/winlogbeat-7.14.0-windows-x86_64.zip"

    urls.append(url64)

def Download(src_path, URL,fp):

    import urllib2

    request = urllib2.Request(URL, headers={'User-Agent' : "Magic Browser"})

    try:

        gcontext = ssl.SSLContext(ssl.PROTOCOL_TLSv1)

        parsed = urllib2.urlopen(request,context=gcontext)

    except:

        parsed = urllib2.urlopen(request)

    if not os.path.exists(src_path):

        os.makedirs(src_path)

    with open(fp, 'wb') as f:

        while True:

            chunk=parsed.read(100*1000*1000)

            if chunk:

                f.write(chunk)

            else:

                break

    return fp

​

def filezip(Excutable_path,dest_path):

    with zipfile.ZipFile(Excutable_path,"r") as zip_ref:

        zip_ref.extractall(dest_path)

        print 'file unzipped to ' +dest_path 

​

def permissions(dirpath):

    mode=0o777

    if os.path.isdir(dirpath):

        try:

            for root,dirs,files in os.walk(dirpath,topdown=False):

                for dircs in [os.path.join(root,d) for d in dirs]:

                    os.chmod(dircs,mode)

                for s_file in [os.path.join(root,f) for f in files]:

                    os.chmod(s_file,mode)

        except Exception as E:

            print "File being Used %s"

​

Folder=os.environ['programdata']+r"\extraction_file"

if not os.path.exists(Folder):

    os.mkdir(Folder)

dest_path=os.environ['programdata']+r"\extraction_file"

for i,j in enumerate(urls):

    fileName=str(i)+"_l"+r".zip"

    src_path=Folder

    fp = os.path.join(src_path, fileName)    

    Excutable_path=Download(Folder,j,fp)

    print "Downloaded succesfully to "+Excutable_path+""

    filezip(Excutable_path,dest_path)

​

permissions(dest_path)

os.chdir(dest_path)

​

############################################YAML_File################################################################

winlogbeat_yaml_file_64="""

    ###################### Winlogbeat Configuration Example ########################

​

    # This file is an example configuration file highlighting only the most common

    # options. The winlogbeat.reference.yml file from the same directory contains

    # all the supported options with more comments. You can use it as a reference.

    #

    # You can find the full configuration reference here:

    # https://www.elastic.co/guide/en/beats/winlogbeat/index.html

​

    # ======================== Winlogbeat specific options =========================

​

    # event_logs specifies a list of event logs to monitor as well as any

    # accompanying options. The YAML data type of event_logs is a list of

    # dictionaries.

    #

    # The supported keys are name (required), tags, fields, fields_under_root,

    # forwarded, ignore_older, level, event_id, provider, and include_xml. Please

    # visit the documentation for the complete details of each option.

    # https://go.es.io/WinlogbeatConfig

​

    winlogbeat.event_logs:

      - name: Application

        ignore_older: 72h

​

      - name: System

​

      - name: Security

        processors:

          - script:

              lang: javascript

              id: security

              file: ${path.home}/module/security/config/winlogbeat-security.js

​

      - name: Microsoft-Windows-Sysmon/Operational

        processors:

          - script:

              lang: javascript

              id: sysmon

              file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js

​

      - name: Windows PowerShell

        event_id: 400, 403, 600, 800

        processors:

          - script:

              lang: javascript

              id: powershell

              file: ${path.home}/module/powershell/config/winlogbeat-powershell.js

​

      - name: Microsoft-Windows-PowerShell/Operational

        event_id: 4103, 4104, 4105, 4106

        processors:

          - script:

              lang: javascript

              id: powershell

              file: ${path.home}/module/powershell/config/winlogbeat-powershell.js

​

      - name: ForwardedEvents

        tags: [forwarded]

        processors:

          - script:

              when.equals.winlog.channel: Security

              lang: javascript

              id: security

              file: ${path.home}/module/security/config/winlogbeat-security.js

          - script:

              when.equals.winlog.channel: Microsoft-Windows-Sysmon/Operational

              lang: javascript

              id: sysmon

              file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js

          - script:

              when.equals.winlog.channel: Windows PowerShell

              lang: javascript

              id: powershell

              file: ${path.home}/module/powershell/config/winlogbeat-powershell.js

          - script:

              when.equals.winlog.channel: Microsoft-Windows-PowerShell/Operational

              lang: javascript

              id: powershell

              file: ${path.home}/module/powershell/config/winlogbeat-powershell.js

​

    # ====================== Elasticsearch template settings =======================

​

    setup.template.settings:

      index.number_of_shards: 1

      #index.codec: best_compression

      #_source.enabled: false

​

​

    # ================================== General ===================================

​

    # The name of the shipper that publishes the network data. It can be used to group

    # all the transactions sent by a single shipper in the web interface.

    #name:

​

    # The tags of the shipper are included in their own field with each

    # transaction published.

    #tags: ["service-X", "web-tier"]

​

    # Optional fields that you can specify to add additional information to the

    # output.

    #fields:

    #  env: staging

​

    # ================================= Dashboards =================================

    # These settings control loading the sample dashboards to the Kibana index. Loading

    # the dashboards is disabled by default and can be enabled either by setting the

    # options here or by using the `setup` command.

    #setup.dashboards.enabled: false

​

    # The URL from where to download the dashboards archive. By default this URL

    # has a value which is computed based on the Beat name and version. For released

    # versions, this URL points to the dashboard archive on the artifacts.elastic.co

    # website.

    #setup.dashboards.url:

​

    # =================================== Kibana ===================================

​

    # Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.

    # This requires a Kibana endpoint configuration.

    setup.kibana:

​

      # Kibana Host

      # Scheme and port can be left out and will be set to the default (http and 5601)

      # In case you specify and additional path, the scheme is required: http://localhost:5601/path

      # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601

      #host: "localhost:5601"

​

      # Kibana Space ID

      # ID of the Kibana Space into which the dashboards should be loaded. By default,

      # the Default Space will be used.

      #space.id:

​

    # =============================== Elastic Cloud ================================

​

    # These settings simplify using Winlogbeat with the Elastic Cloud (https://cloud.elastic.co/).

​

    # The cloud.id setting overwrites the `output.elasticsearch.hosts` and

    # `setup.kibana.host` options.

    # You can find the `cloud.id` in the Elastic Cloud web UI.

    #cloud.id:

​

    # The cloud.auth setting overwrites the `output.elasticsearch.username` and

    # `output.elasticsearch.password` settings. The format is `<user>:<pass>`.

    #cloud.auth:

​

    # ================================== Outputs ===================================

​

    # Configure what output to use when sending the data collected by the beat.

​

    # ---------------------------- Elasticsearch Output ----------------------------

    output.elasticsearch:

      # Array of hosts to connect to.

      #hosts: ["localhost:9200"]

​

      # Protocol - either `http` (default) or `https`.

      #protocol: "https"

​

      # Authentication credentials - either API key or username/password.

      #api_key: "id:api_key"

      #username: "elastic"

      #password: "changeme"

​

    # ------------------------------ Logstash Output -------------------------------

    #output.logstash:

      # The Logstash hosts

      hosts: ["localhost:5044"]

​

      # Optional SSL. By default is off.

      # List of root certificates for HTTPS server verifications

      #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

​

      # Certificate for SSL client authentication

      #ssl.certificate: "/etc/pki/client/cert.pem"

​

      # Client Certificate Key

      #ssl.key: "/etc/pki/client/cert.key"

​

    # ================================= Processors =================================

    processors:

      - add_host_metadata:

          when.not.contains.tags: forwarded

      - add_cloud_metadata: ~

​

    # ================================== Logging ===================================

​

    # Sets log level. The default log level is info.

    # Available log levels are: error, warning, info, debug

    #logging.level: debug

​

    # At debug level, you can selectively enable logging only for some components.

    # To enable all selectors use ["*"]. Examples of other selectors are "beat",

    # "publisher", "service".

    #logging.selectors: ["*"]

​

    # ============================= X-Pack Monitoring ==============================

    # Winlogbeat can export internal metrics to a central Elasticsearch monitoring

    # cluster.  This requires xpack monitoring to be enabled in Elasticsearch.  The

    # reporting is disabled by default.

​

    # Set to true to enable the monitoring reporter.

    #monitoring.enabled: false

​

    # Sets the UUID of the Elasticsearch cluster under which monitoring data for this

    # Winlogbeat instance will appear in the Stack Monitoring UI. If output.elasticsearch

    # is enabled, the UUID is derived from the Elasticsearch cluster referenced by output.elasticsearch.

    #monitoring.cluster_uuid:

​

    # Uncomment to send the metrics to Elasticsearch. Most settings from the

    # Elasticsearch output are accepted here as well.

    # Note that the settings should point to your Elasticsearch *monitoring* cluster.

    # Any setting that is not set is automatically inherited from the Elasticsearch

    # output configuration, so if you have the Elasticsearch output configured such

    # that it is pointing to your Elasticsearch monitoring cluster, you can simply

    # uncomment the following line.

    #monitoring.elasticsearch:

​

    # ============================== Instrumentation ===============================

​

    # Instrumentation support for the winlogbeat.

    #instrumentation:

        # Set to true to enable instrumentation of winlogbeat.

        #enabled: false

​

        # Environment in which winlogbeat is running on (eg: staging, production, etc.)

        #environment: ""

​

        # APM Server hosts to report instrumentation results to.

        #hosts:

        #  - http://localhost:8200

​

        # API Key for the APM Server(s).

        # If api_key is set then secret_token will be ignored.

        #api_key:

​

        # Secret token for the APM Server(s).

        #secret_token:

​

​

    # ================================= Migration ==================================

​

    # This allows to enable 6.7 migration aliases

    #migration.6_to_7.enabled: true

​

​

    """

​

winlogbeat_yaml_file_32="""

    ###################### Winlogbeat Configuration Example ########################

​

    # This file is an example configuration file highlighting only the most common

    # options. The winlogbeat.reference.yml file from the same directory contains

    # all the supported options with more comments. You can use it as a reference.

    #

    # You can find the full configuration reference here:

    # https://www.elastic.co/guide/en/beats/winlogbeat/index.html

​

    # ======================== Winlogbeat specific options =========================

​

    # event_logs specifies a list of event logs to monitor as well as any

    # accompanying options. The YAML data type of event_logs is a list of

    # dictionaries.

    #

    # The supported keys are name (required), tags, fields, fields_under_root,

    # forwarded, ignore_older, level, event_id, provider, and include_xml. Please

    # visit the documentation for the complete details of each option.

    # https://go.es.io/WinlogbeatConfig

​

    winlogbeat.event_logs:

      - name: Application

        ignore_older: 72h

​

      - name: System

​

      - name: Security

        processors:

          - script:

              lang: javascript

              id: security

              file: ${path.home}/module/security/config/winlogbeat-security.js

​

      - name: Microsoft-Windows-Sysmon/Operational

        processors:

          - script:

              lang: javascript

              id: sysmon

              file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js

​

      - name: Windows PowerShell

        event_id: 400, 403, 600, 800

        processors:

          - script:

              lang: javascript

              id: powershell

              file: ${path.home}/module/powershell/config/winlogbeat-powershell.js

​

      - name: Microsoft-Windows-PowerShell/Operational

        event_id: 4103, 4104, 4105, 4106

        processors:

          - script:

              lang: javascript

              id: powershell

              file: ${path.home}/module/powershell/config/winlogbeat-powershell.js

​

      - name: ForwardedEvents

        tags: [forwarded]

        processors:

          - script:

              when.equals.winlog.channel: Security

              lang: javascript

              id: security

              file: ${path.home}/module/security/config/winlogbeat-security.js

          - script:

              when.equals.winlog.channel: Microsoft-Windows-Sysmon/Operational

              lang: javascript

              id: sysmon

              file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js

          - script:

              when.equals.winlog.channel: Windows PowerShell

              lang: javascript

              id: powershell

              file: ${path.home}/module/powershell/config/winlogbeat-powershell.js

          - script:

              when.equals.winlog.channel: Microsoft-Windows-PowerShell/Operational

              lang: javascript

              id: powershell

              file: ${path.home}/module/powershell/config/winlogbeat-powershell.js

​

    # ====================== Elasticsearch template settings =======================

​

    setup.template.settings:

      index.number_of_shards: 1

      #index.codec: best_compression

      #_source.enabled: false

​

​

    # ================================== General ===================================

​

    # The name of the shipper that publishes the network data. It can be used to group

    # all the transactions sent by a single shipper in the web interface.

    #name:

​

    # The tags of the shipper are included in their own field with each

    # transaction published.

    #tags: ["service-X", "web-tier"]

​

    # Optional fields that you can specify to add additional information to the

    # output.

    #fields:

    #  env: staging

​

    # ================================= Dashboards =================================

    # These settings control loading the sample dashboards to the Kibana index. Loading

    # the dashboards is disabled by default and can be enabled either by setting the

    # options here or by using the `setup` command.

    #setup.dashboards.enabled: false

​

    # The URL from where to download the dashboards archive. By default this URL

    # has a value which is computed based on the Beat name and version. For released

    # versions, this URL points to the dashboard archive on the artifacts.elastic.co

    # website.

    #setup.dashboards.url:

​

    # =================================== Kibana ===================================

​

    # Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.

    # This requires a Kibana endpoint configuration.

    setup.kibana:

​

      # Kibana Host

      # Scheme and port can be left out and will be set to the default (http and 5601)

      # In case you specify and additional path, the scheme is required: http://localhost:5601/path

      # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601

      #host: "localhost:5601"

​

      # Kibana Space ID

      # ID of the Kibana Space into which the dashboards should be loaded. By default,

      # the Default Space will be used.

      #space.id:

​

    # =============================== Elastic Cloud ================================

​

    # These settings simplify using Winlogbeat with the Elastic Cloud (https://cloud.elastic.co/).

​

    # The cloud.id setting overwrites the `output.elasticsearch.hosts` and

    # `setup.kibana.host` options.

    # You can find the `cloud.id` in the Elastic Cloud web UI.

    #cloud.id:

​

    # The cloud.auth setting overwrites the `output.elasticsearch.username` and

    # `output.elasticsearch.password` settings. The format is `<user>:<pass>`.

    #cloud.auth:

​

    # ================================== Outputs ===================================

​

    # Configure what output to use when sending the data collected by the beat.

​

    # ---------------------------- Elasticsearch Output ----------------------------

    output.elasticsearch:

      # Array of hosts to connect to.

      #hosts: ["localhost:9200"]

​

      # Protocol - either `http` (default) or `https`.

      #protocol: "https"

​

      # Authentication credentials - either API key or username/password.

      #api_key: "id:api_key"

      #username: "elastic"

      #password: "changeme"

​

    # ------------------------------ Logstash Output -------------------------------

    #output.logstash:

      # The Logstash hosts

      hosts: ["localhost:5044"]

​

      # Optional SSL. By default is off.

      # List of root certificates for HTTPS server verifications

      #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

​

      # Certificate for SSL client authentication

      #ssl.certificate: "/etc/pki/client/cert.pem"

​

      # Client Certificate Key

      #ssl.key: "/etc/pki/client/cert.key"

​

    # ================================= Processors =================================

    processors:

      - add_host_metadata:

          when.not.contains.tags: forwarded

      - add_cloud_metadata: ~

​

    # ================================== Logging ===================================

​

    # Sets log level. The default log level is info.

    # Available log levels are: error, warning, info, debug

    #logging.level: debug

​

    # At debug level, you can selectively enable logging only for some components.

    # To enable all selectors use ["*"]. Examples of other selectors are "beat",

    # "publisher", "service".

    #logging.selectors: ["*"]

​

    # ============================= X-Pack Monitoring ==============================

    # Winlogbeat can export internal metrics to a central Elasticsearch monitoring

    # cluster.  This requires xpack monitoring to be enabled in Elasticsearch.  The

    # reporting is disabled by default.

​

    # Set to true to enable the monitoring reporter.

    #monitoring.enabled: false

​

    # Sets the UUID of the Elasticsearch cluster under which monitoring data for this

    # Winlogbeat instance will appear in the Stack Monitoring UI. If output.elasticsearch

    # is enabled, the UUID is derived from the Elasticsearch cluster referenced by output.elasticsearch.

    #monitoring.cluster_uuid:

​

    # Uncomment to send the metrics to Elasticsearch. Most settings from the

    # Elasticsearch output are accepted here as well.

    # Note that the settings should point to your Elasticsearch *monitoring* cluster.

    # Any setting that is not set is automatically inherited from the Elasticsearch

    # output configuration, so if you have the Elasticsearch output configured such

    # that it is pointing to your Elasticsearch monitoring cluster, you can simply

    # uncomment the following line.

    #monitoring.elasticsearch:

​

    # ============================== Instrumentation ===============================

​

    # Instrumentation support for the winlogbeat.

    #instrumentation:

        # Set to true to enable instrumentation of winlogbeat.

        #enabled: false

​

        # Environment in which winlogbeat is running on (eg: staging, production, etc.)

        #environment: ""

​

        # APM Server hosts to report instrumentation results to.

        #hosts:

        #  - http://localhost:8200

​

        # API Key for the APM Server(s).

        # If api_key is set then secret_token will be ignored.

        #api_key:

​

        # Secret token for the APM Server(s).

        #secret_token:

​

​

    # ================================= Migration ==================================

​

    # This allows to enable 6.7 migration aliases

    #migration.6_to_7.enabled: true

​

​

​

    """

​

############################################Yaml_file_creation_complete##############################################

​

if "32" in os_arch:  

    directory=[i for i,j,k in os.walk(dest_path)][1]

    os.chdir(directory)

    print("Configuring yaml file...")

    permissions(directory)

    with open(directory+"\\winlogbeat.yml","w") as f:

        f.write(winlogbeat_yaml_file_32)

    with disable_file_system_redirection():

        os.popen('powershell "Set-ExecutionPolicy RemoteSigned"')

        obj2=Popen("""powershell.exe '-Exec bypass -File .\install-service-winlogbeat.ps1' && powershell.exe 'Set-Service -Name "winlogbeat" -StartupType automatic' && powershell.exe 'Start-Service  -Name "winlogbeat"'""",stdout=PIPE,stderr=PIPE,shell=True)

    res2,err2=obj2.communicate()

    if err2:

        print(err2)

    else:

        print(res2)

    if obj2.returncode==0:

        print("winlogbeat Installed Successfully")

    else:

        print("Failed to install winlogbeat returncode %s"%(obj2.returncode))

elif "64" in os_arch:

    directory=[i for i,j,k in os.walk(dest_path)][1]

    os.chdir(directory)

    print("Configuring yaml file...")

    permissions(directory)

    with open(directory+"\\winlogbeat.yml","w") as f:

        f.write(winlogbeat_yaml_file_32)

    with disable_file_system_redirection():

        os.popen('powershell "Set-ExecutionPolicy RemoteSigned"')

        obj2=Popen("""powershell.exe '-Exec bypass -File .\install-service-winlogbeat.ps1' && powershell.exe 'Set-Service -Name "winlogbeat" -StartupType automatic' && powershell.exe 'Start-Service  -Name "winlogbeat"'""",stdout=PIPE,stderr=PIPE,shell=True)

    res2,err2=obj2.communicate()

    if err2:

        print(err2)

    else:

        print(res2)

    if obj2.returncode==0:

        print("winlogbeat Installed Successfully")

    else:

        print("Failed to install winlogbeat returncode %s"%(obj2.returncode))