{"id":31289,"date":"2019-10-31T21:40:29","date_gmt":"2019-10-31T18:40:29","guid":{"rendered":"https:\/\/prohoster.info\/blog\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows\/"},"modified":"2019-10-31T21:40:29","modified_gmt":"2019-10-31T18:40:29","slug":"chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","title":{"rendered":"What useful information can be extracted from the logs of a Windows OS workstation","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>User workstations are the most vulnerable aspect of the infrastructure regarding information security. Users may receive emails on their work accounts that appear to be from a safe source, but link to an infected site. It's possible that someone could download a useful utility for work from an unknown location. Many scenarios can be conceived of how malware can infiltrate corporate resources through users. Therefore, workstations require heightened attention, and in this article, we will discuss where and what events to monitor for detecting attacks.<\/p>\n<p><img decoding=\"async\" alt=\"What useful information can be extracted from the logs of a Windows OS workstation\" src=\"\/wp-content\/uploads\/2019\/04\/6e0eddfc90ae158b3d532a6b7a069177.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>To detect an attack at the earliest stage in Windows OS, there are three useful event sources: Security Event Log, System Log, and PowerShell Logs.<\/p>\n<h2>Security Event Log<\/h2>\n<p>\nThis is the main store of system security logs. It contains events related to user logins\/logouts, object access, policy changes, and other activities related to security. Of course, this requires specific policy settings.<\/p>\n<p><img decoding=\"async\" alt=\"What useful information can be extracted from the logs of a Windows OS workstation\" src=\"\/wp-content\/uploads\/2019\/04\/82e59ad17a09a8211dc6fe9737208fd7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>User and group enumeration (events 4798 and 4799).<\/b> Malware often starts the attack by enumerating local user accounts and local groups on the workstation to find credentials for its nefarious purposes. These events can help detect malware before it moves further and spreads to other systems using the gathered data.<\/p>\n<p><b>Creation of local account and changes in local groups (events 4720, 4722\u20134726, 4738, 4740, 4767, 4780, 4781, 4794, 5376, and 5377).<\/b> An attack can also start, for example, with the addition of a new user to the local administrators group.<\/p>\n<p><b>Login attempts with a local account (event 4624).<\/b> Honest users log in with domain accounts, and the detection of a login with a local account may indicate the beginning of an attack. Event 4624 also includes logins under domain accounts, so when processing events, it's necessary to filter out events where the domain differs from the workstation name.<\/p>\n<p><b>Login attempt with a specified account (event 4648).<\/b> This can happen when a process runs in 'Run as' mode. In normal operational mode, this shouldn't occur, so such events should be monitored.<\/p>\n<p><b>Locking\/unlocking the workstation (events 4800-4803).<\/b> Any actions that took place on a locked workstation can be classified as suspicious events.<\/p>\n<p><b>Changes to firewall configuration (events 4944-4958).<\/b> It is obvious that when installing new software, the firewall configuration settings may change, causing false positives. In most cases, there is no need to monitor such changes, but it wouldn't hurt to be aware of them.<\/p>\n<p><b>Connecting Plug\u2019n\u2019play devices (event 6416 and only for Windows 10).<\/b> It is important to monitor this if users typically do not connect new devices to the workstation, and suddenly they did.<\/p>\n<p>Windows includes 9 audit categories and 50 subcategories for fine-tuning. The minimum set of subcategories worth enabling in the settings is:<\/p>\n<p><b>Logon\/Logoff<\/b><\/p>\n<ul>\n<li>Logon;<\/li>\n<li>Logoff;<\/li>\n<li>Account Lockout;<\/li>\n<li>Other Logon\/Logoff Events.<\/li>\n<\/ul>\n<p>\n<b>Account Management<\/b><\/p>\n<ul>\n<li>User Account Management;<\/li>\n<li>Security Group Management.<\/li>\n<\/ul>\n<p>\n<b>Policy Change<\/b><\/p>\n<ul>\n<li>Audit Policy Change;<\/li>\n<li>Authentication Policy Change;<\/li>\n<li>Authorization Policy Change.<\/li>\n<\/ul>\n<p><\/p>\n<h2>System Monitor (Sysmon)<\/h2>\n<p>\nSysmon is a built-in Windows utility that can log events to the system log. Usually, it needs to be installed separately.<\/p>\n<p><img decoding=\"async\" alt=\"What useful information can be extracted from the logs of a Windows OS workstation\" src=\"\/wp-content\/uploads\/2019\/04\/0b1e14fb9ba4d63a4d9d94bd9d62d112.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nThese events can generally be found in the security log (by enabling the necessary audit policy), but Sysmon provides more details. What events can be retrieved from Sysmon?<\/p>\n<p><b>Process creation (event ID 1).<\/b> The system security event log can also indicate when an *.exe was launched and can even show its name and launch path. However, unlike Sysmon, it cannot display the application's hash. Malicious software can be disguised as harmless notepad.exe, but the hash will reveal its true nature.<\/p>\n<p><b>Network connections (event ID 3).<\/b> There are many network connections, and it's impossible to track them all. However, it is important to note that Sysmon, unlike the Security Log, can tie a network connection to the ProcessID and ProcessGUID fields, showing the port and <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/en\/lir\/ipv4\/\"   title=\"an IP address\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"622\">an IP address<\/a> source and destination.<\/p>\n<p><b>Changes in the system registry (event ID 12-14).<\/b> The easiest way to add yourself to the startup is to register in the registry. Security Log can do this, but Sysmon shows who made the changes, when, from where, the process ID, and the previous value of the key.<\/p>\n<p><b>File creation (Event ID 11).<\/b> Unlike Security Log, Sysmon will show not only the location of the file but also its name. It's clear that you can't monitor everything, but you can audit specific directories.<\/p>\n<p>And now for what is not in the Security Log policies but exists in Sysmon:<\/p>\n<p><b>File creation time change (Event ID 2).<\/b> Some malware can alter the file creation date to hide it from reports of recently created files.<\/p>\n<p><b>Loading drivers and dynamic libraries (Event IDs 6-7).<\/b> Monitoring the loading of DLLs and device drivers into memory, checking the digital signature and its validity.<\/p>\n<p><b>Creating a thread in a running process (Event ID 8).<\/b> One type of attack that also needs to be monitored.<\/p>\n<p><b>RawAccessRead events (Event ID 9).<\/b> Disk read operations using \u2018.\u2019. In the vast majority of cases, such activity should be considered abnormal.<\/p>\n<p><b>Creating a named file stream (Event ID 15).<\/b> The event is logged when a named file stream is created, generating events with the file's content hash.<\/p>\n<p><b>Creating named pipes and connections (Event IDs 17-18).<\/b> Monitoring malicious code that communicates with other components through named pipes.<\/p>\n<p><b>WMI activity (Event ID 19).<\/b> Logging events generated when accessing the system via the WMI protocol.<\/p>\n<p>To protect Sysmon itself, you need to monitor events with ID 4 (stopping and starting Sysmon) and ID 16 (changing Sysmon configuration).<\/p>\n<h2>PowerShell logs<\/h2>\n<p>\nPowerShell is a powerful tool for managing Windows infrastructure, so there is a high chance that an attacker will choose it. To obtain data about PowerShell events, you can use two sources: Windows PowerShell log and Microsoft-WindowsPowerShell \/ Operational log.<\/p>\n<h4>Windows PowerShell log<\/h4>\n<p>\n<img decoding=\"async\" alt=\"What useful information can be extracted from the logs of a Windows OS workstation\" src=\"\/wp-content\/uploads\/2019\/04\/03d830871fc2c47ceeb8f0822f3f20e0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Data provider loaded (Event ID 600).<\/b> PowerShell providers are programs that serve as data sources for PowerShell for viewing and managing them. For example, built-in providers may include Windows environment variables or the system registry. It is important to monitor the emergence of new providers to timely detect malicious activity. For instance, if you notice that WSMan has appeared among the providers, it means that a remote PowerShell session has been initiated.<\/p>\n<h4>Microsoft-WindowsPowerShell \/ Operational log (or MicrosoftWindows-PowerShellCore \/ Operational in PowerShell 6)<\/h4>\n<p>\n<img decoding=\"async\" alt=\"What useful information can be extracted from the logs of a Windows OS workstation\" src=\"\/wp-content\/uploads\/2019\/04\/d0a1a74aad59c7c4f64446b52846429f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Module logging (Event ID 4103).<\/b> The events store information about each executed command and the parameters with which it was called.<\/p>\n<p><b>Script block logging (Event ID 4104).<\/b> Script block logging shows every executed PowerShell code block. Even if an attacker tries to hide the command, this type of event will reveal the actual executed PowerShell command. Additionally, this type of event may log some executed low-level API calls, these events are usually recorded as Verbose, but if a suspicious command or script is used in a code block, it will be registered with a severity of Warning.<\/p>\n<p>Please note that after configuring the tool for collecting and analyzing these events, additional time will be required for debugging to reduce false positives.<\/p>\n<p>Tell us in the comments what logs you collect for information security audits and what tools you use for this. One of our focuses is solutions for auditing information security events. For the task of collecting and analyzing logs, we can suggest looking at <noindex><a rel=\"nofollow\" href=\"https:\/\/www.quest.com\/products\/intrust\/\">Quest InTrust<\/a><\/noindex>, which can compress stored data at a ratio of 20:1, and a single installed instance can process up to 60,000 events per second from 10,000 sources.<br \/>\n<br \/>Source: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/447522\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0439\u0442\u0438 \u043d\u0430 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u043f\u043e\u0447\u0442\u0443 \u043f\u0438\u0441\u044c\u043c\u043e \u0432\u0440\u043e\u0434\u0435 \u0431\u044b \u0438\u0437 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430, \u043d\u043e \u0441\u043e \u0441\u0441\u044b\u043b\u043a\u043e\u0439 \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0439 \u0441\u0430\u0439\u0442. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u043a\u0442\u043e-\u0442\u043e \u0441\u043a\u0430\u0447\u0430\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0443\u0442\u0438\u043b\u0438\u0442\u0443 \u0438\u0437 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u043a\u0430\u043a\u043e\u0433\u043e \u043c\u0435\u0441\u0442\u0430. \u0414\u0430 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u0438\u0434\u0443\u043c\u0430\u0442\u044c \u043d\u0435 \u043e\u0434\u0438\u043d \u0434\u0435\u0441\u044f\u0442\u043e\u043a \u043a\u0435\u0439\u0441\u043e\u0432, \u043a\u0430\u043a \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043c\u043e\u0436\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c\u0441\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23255,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31289","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0427\u0442\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0432\u044b\u0442\u0430\u0449\u0438\u0442\u044c \u0438\u0437 \u043b\u043e\u0433\u043e\u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0441\u0442\u0430\u043d\u0446\u0438\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 \u041e\u0421 Windows | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:40:29+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:40:29+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47What useful information can be extracted from Windows OS-based workstation logs | ProHoster","description":"The user workstation is the most vulnerable point in the infrastructure in terms of information security.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0442\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0432\u044b\u0442\u0430\u0449\u0438\u0442\u044c \u0438\u0437 \u043b\u043e\u0433\u043e\u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0441\u0442\u0430\u043d\u0446\u0438\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 \u041e\u0421 Windows | ProHoster","og:description":"\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:40:29+00:00","article:modified_time":"2019-10-31T18:40:29+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31289","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:25:31","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:19:49","updated":"2026-02-08 20:25:31","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/31289","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=31289"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/31289\/revisions"}],"predecessor-version":[{"id":157813,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/31289\/revisions\/157813"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/23255"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=31289"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=31289"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=31289"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}