{"id":31289,"date":"2019-10-31T21:40:29","date_gmt":"2019-10-31T18:40:29","guid":{"rendered":"https:\/\/prohoster.info\/blog\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows\/"},"modified":"2019-10-31T21:40:29","modified_gmt":"2019-10-31T18:40:29","slug":"chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","title":{"rendered":"Mida kasulikku saab Windowsi operatsioonis\u00fcsteemiga t\u00f6\u00f6jaama logidest v\u00e4lja v\u00f5tta","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Kasutaja t\u00f6\u00f6jaam on infrastruktuuri k\u00f5ige haavatavam koht teabe turvalisuse osas. Kasutajatele v\u00f5ib tulla t\u00f6\u00f6meili kaudu kiri, mis n\u00e4ib olevat usaldusv\u00e4\u00e4rsest allikast, kuid sisaldab linki nakatunud veebisaidile. V\u00f5ib juhtuda, et keegi laadib alla kasulikku t\u00f6\u00f6riista tundmatust allikast. V\u00f5ib v\u00e4lja m\u00f5elda k\u00fcmneid olukordi, kuidas pahavara kasutajate kaudu ettev\u00f5tte sisemistele ressurssidele tungida. Seet\u00f5ttu vajavad t\u00f6\u00f6jaamad erilise t\u00e4helepanu ja artiklis r\u00e4\u00e4gime, kust ja milliseid s\u00fcndmusi j\u00e4lgida r\u00fcnnakute tuvastamiseks.<\/p>\n<p><img decoding=\"async\" alt=\"Mida kasulikku saab Windowsi operatsioonis\u00fcsteemiga t\u00f6\u00f6jaama logidest v\u00e4lja v\u00f5tta\" src=\"\/wp-content\/uploads\/2019\/04\/6e0eddfc90ae158b3d532a6b7a069177.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>R\u00fcnnaku tuvastamiseks v\u00f5imalikult varajases staadiumis on Windowsi operatsioonis\u00fcsteemis kolm kasulikku s\u00fcndmusteallikat: turvalogide ajakiri, s\u00fcsteemi monitorimise ajakiri ja PowerShelli logid.<\/p>\n<h2>Turvalogide ajakiri (Security Log)<\/h2>\n<p>\nSee on peamine koht turvalogide talletamiseks. Siia kogunevad kasutajate sisselogimise\/v\u00e4ljalogimise, objektide ligip\u00e4\u00e4sude, poliitika muutmise ja teiste turvalisusega seotud tegevuste s\u00fcndmused. Loomulikult, kui on konfigureeritud vastav poliitika.<\/p>\n<p><img decoding=\"async\" alt=\"Mida kasulikku saab Windowsi operatsioonis\u00fcsteemiga t\u00f6\u00f6jaama logidest v\u00e4lja v\u00f5tta\" src=\"\/wp-content\/uploads\/2019\/04\/82e59ad17a09a8211dc6fe9737208fd7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Kasutajien ja r\u00fchmade l\u00e4bilaskmine (s\u00fcndmused 4798 ja 4799).<\/b> Pahavara r\u00fcnnaku alguses proovib sageli kohalikud kasutajakontod ja r\u00fchmaliikmed t\u00f6\u00f6jaamas l\u00e4bi k\u00e4ia, et leida vajalikud andmed oma tumedate kavatsuste jaoks. Need s\u00fcndmused aitavad tuvastada pahavara kiiremini, enne kui see edasi liigub ja kogutud andmeid kasutades teiste s\u00fcsteemide peale laieneb.<\/p>\n<p><b>Kohaliku kasutajakonto loomine ja muudatused kohalikes gruppides (s\u00fcndmused 4720, 4722\u20134726, 4738, 4740, 4767, 4780, 4781, 4794, 5376 ja 5377).<\/b> R\u00fcnnak v\u00f5ib alata n\u00e4iteks uue kasutaja lisamisest kohalike administraatorite r\u00fchma.<\/p>\n<p><b>\u00dcritused sisselogida kohaliku kasutajakontoga (s\u00fcndmus 4624).<\/b> Heausked kasutajad logivad sisse domeeni kasutajakontoga ja kohaliku kasutajakonto alusel sisselogimise tuvastamine v\u00f5ib t\u00e4hendada r\u00fcnnaku algust. S\u00fcndmus 4624 h\u00f5lmab ka sisselogimist domeeni kasutajakontoga, seega s\u00fcndmuste t\u00f6\u00f6tlemisel tuleb filtreerida v\u00e4lja need s\u00fcndmused, kus domeen erineb t\u00f6\u00f6jaama nimest.<\/p>\n<p><b>\u00dcritus sisselogida kindla kasutajakontoga (s\u00fcndmus 4648).<\/b> Selline asi v\u00f5ib juhtuda, kui protsess k\u00e4ivitub \"K\u00e4ivita administraatorina\" re\u017eiimis. Tavalistes s\u00fcsteemi t\u00f6\u00f6re\u017eiimides ei tohiks selliseid olukordi esineda, seega peaksid sellised s\u00fcndmused olema kontrolli all.<\/p>\n<p><b>T\u00f6\u00f6kohaga lukustamine\/\u00fclal hoidmine (s\u00fcndmused 4800-4803).<\/b> Kahtlaste s\u00fcndmuste kategooriaga v\u00f5ib seostada k\u00f5ik tegevused, mis toimusid lukustatud t\u00f6\u00f6tajas.<\/p>\n<p><b>Tulekahju seinale tehtud muudatused (s\u00fcndmused 4944-4958).<\/b> On selge, et uue tarkvara installimisel v\u00f5ivad tulemuste konfiguratsiooniseaded muutuda, mis v\u00f5ib p\u00f5hjustada valeh\u00e4ireid. Selliseid muudatusi enamasti j\u00e4lgima ei pea, kuid nende olemasolust teadlik olemine ei tee paha.<\/p>\n<p><b>Plug\u2019n\u2019play seadmete \u00fchendamine (s\u00fcndmus 6416 ja ainult Windows 10 puhul).<\/b> Siin on oluline t\u00e4helepanelik olla, kui kasutajad tavaliselt ei \u00fchenda uusi seadmeid oma t\u00f6\u00f6jaama, kuid n\u00fc\u00fcd j\u00e4rsku \u2013 ja \u00fchendasid.<\/p>\n<p>Windows h\u00f5lmab 9 auditi kategooriat ja 50 alajaotust peenh\u00e4\u00e4lestamiseks. Miinimumkomplekt alajaotusi, mille lubamine seadetest on soovitatav:<\/p>\n<p><b>Sisselogimine\/Sisselogimisest v\u00e4ljumine<\/b><\/p>\n<ul>\n<li>Sisselogimine;<\/li>\n<li>V\u00e4ljumine;<\/li>\n<li>Kontode lukustamine;<\/li>\n<li>Teised sisselogimisest v\u00e4ljumise s\u00fcndmused.<\/li>\n<\/ul>\n<p>\n<b>Konto haldamine<\/b><\/p>\n<ul>\n<li>Kasutajakonto haldamine;<\/li>\n<li>Turvagruppide haldamine.<\/li>\n<\/ul>\n<p>\n<b>Poliitika muutus<\/b><\/p>\n<ul>\n<li>Auditi poliitika muutmine;<\/li>\n<li>Autentimise poliitika muutmine;<\/li>\n<li>Volituste poliitika muutmine.<\/li>\n<\/ul>\n<p><\/p>\n<h2>S\u00fcsteemi monitor (Sysmon)<\/h2>\n<p>\nSysmon on Windowsi sisseehitatud utiliit, mis oskab salvestada s\u00fcndmusi s\u00fcsteemiv\u00e4ljaande logisse. Tavaliselt tuleb see eraldi installida.<\/p>\n<p><img decoding=\"async\" alt=\"Mida kasulikku saab Windowsi operatsioonis\u00fcsteemiga t\u00f6\u00f6jaama logidest v\u00e4lja v\u00f5tta\" src=\"\/wp-content\/uploads\/2019\/04\/0b1e14fb9ba4d63a4d9d94bd9d62d112.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNeed s\u00fcndmused on p\u00f5him\u00f5tteliselt ka turvaprogrammi logides leitavad (luba sobiv auditi poliitika), kuid Sysmon annab rohkem detaile. Milliseid s\u00fcndmusi saab Sysmonist v\u00e4lja v\u00f5tta?<\/p>\n<p><b>Protsessi loomine (s\u00fcndmuse ID 1).<\/b> S\u00fcsteemiv\u00e4ljaande turvaaruande logi \u00fctleb samuti, millal m\u00f5ni *.exe k\u00e4ivitus ja n\u00e4itab isegi selle nime ja k\u00e4ivitusteed. Kuid erinevalt Sysmonist ei suuda see n\u00e4idata rakenduse hash\u2019i. K\u00fcberkuritegevus v\u00f5ib nimetada isegi kahjutuks notepad.exe, kuid just hash paljastab selle.<\/p>\n<p><b>V\u00f5rgup\u00f6\u00f6rdumised (s\u00fcndmuse ID 3).<\/b> Selge on, et v\u00f5rgu\u00fchendusi on palju ja k\u00f5iki ei suuda j\u00e4lgida. Kuid on oluline m\u00e4rkida, et Sysmon, erinevalt turvalogist, suudab siduda v\u00f5rgu\u00fchenduse ProcessID ja ProcessGUID v\u00e4ljadega, ja n\u00e4itab sadamat ning <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/lir\/ipv4\/\"   title=\"IP-aadressid\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"622\">IP-aadressid<\/a> allika ja sihtpunkti.<\/p>\n<p><b>Muudatused s\u00fcsteemi registris (s\u00fcndmuse ID 12-14).<\/b> Lihtsaim viis enda lisamiseks automaatk\u00e4ivitusse on registrisse kandmine. Security Log suudab seda teha, kuid Sysmon n\u00e4itab, kes on muudatused teinud, millal, kust, protsessi ID ja eelmine v\u00e4\u00e4rtus.<\/p>\n<p><b>Faili loomine (s\u00fcndmuse ID 11).<\/b> Sysmon, erinevalt Security Log\u2019ist, n\u00e4itab mitte ainult faili asukohta, vaid ka selle nime. Loomulikult ei saa iga detaili j\u00e4lgida, kuid teatud kaustade auditit on v\u00f5imalik teostada.<\/p>\n<p>Ja n\u00fc\u00fcd see, mida Security Log poliitikas ei ole, kuid mida pakub Sysmon:<\/p>\n<p><b>Faili loomise aja muutmine (s\u00fcndmuse ID 2).<\/b> M\u00f5ned pahavara t\u00fc\u00fcbid v\u00f5ivad muuta faili loomise kuup\u00e4eva, et see varjaks hiljuti loodud failide aruannetest.<\/p>\n<p><b>Draiverite ja d\u00fcnaamiliste raamatukogude laadimine (s\u00fcndmuste ID-d 6-7).<\/b> DLL ja seadme draiverite m\u00e4lus laadimise j\u00e4lgimine, digitaalallkirja ja selle kehtivuse kontrollimine.<\/p>\n<p><b>Protsessis t\u00f6\u00f6tava voolu loomine (s\u00fcndmuse ID 8).<\/b> \u00dcks r\u00fcnnete t\u00fc\u00fcpidest, mida tuleb samuti j\u00e4lgida.<\/p>\n<p><b>RawAccessRead s\u00fcndmused (s\u00fcndmuse ID 9).<\/b> Operatsioonid, mis loevad kettalt kasutades \u201c.\u201d. Enamikul juhtudel peaks selline tegevus olema ebanormaalne.<\/p>\n<p><b>Nimetatud failivoose loomine (s\u00fcndmuse ID 15).<\/b> S\u00fcndmus registreeritakse, kui luuakse nimetatud failivoog, mis genereerib s\u00fcndmusi faili sisu hash'iga.<\/p>\n<p><b>Nimetatud pipe loomine ja \u00fchendamine (s\u00fcndmuste ID-d 17-18).<\/b> Pahavara tegevuse j\u00e4lgimine, mis suhtleb teiste komponentidega kaudu nimetatud pipe.<\/p>\n<p><b>WMI tegevus (s\u00fcndmuse ID 19).<\/b> S\u00fcndmuste registreerimine, mis genereeritakse, kui s\u00fcsteemile p\u00f6\u00f6rdutakse WMI protokolli kaudu.<\/p>\n<p>Sysmoni kaitsmiseks tuleb j\u00e4lgida s\u00fcndmusi, mille ID on 4 (Sysmoni peatamine ja k\u00e4ivitamine) ja ID 16 (Sysmoni konfiguratsiooni muutmine).<\/p>\n<h2>Power Shelli logid<\/h2>\n<p>\nPower Shell on v\u00f5imas Windowsi infrastruktuuri haldust\u00f6\u00f6riist, seega on t\u00f5en\u00e4oline, et r\u00fcndaja valib just selle. Power Shelli s\u00fcndmuste andmete saamiseks saab kasutada kahte allikat: Windows PowerShell logi ja Microsoft-WindowsPowerShell \/ Operational logi.<\/p>\n<h4>Windows PowerShell logi<\/h4>\n<p>\n<img decoding=\"async\" alt=\"Mida kasulikku saab Windowsi operatsioonis\u00fcsteemiga t\u00f6\u00f6jaama logidest v\u00e4lja v\u00f5tta\" src=\"\/wp-content\/uploads\/2019\/04\/03d830871fc2c47ceeb8f0822f3f20e0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Andmete pakkuja laadimine (s\u00fcndmuse ID 600).<\/b> PowerShelli tarnijad on programmid, mis teenivad PowerShelli andmete allikana nende vaatamiseks ja haldamiseks. N\u00e4iteks v\u00f5ivad sisseehitatud tarnijad olla Windowsi keskkonnamuutujad v\u00f5i s\u00fcsteemi registri andmed. On oluline j\u00e4lgida uusi tarnijaid, et tuvastada v\u00f5imalikke pahatahtlikke tegevusi. N\u00e4iteks, kui n\u00e4ete, et tarnijate seas on WSMan, t\u00e4hendab see, et on alanud kaugsessioon PowerShellis.<\/p>\n<h4>Microsoft-WindowsPowerShell \/ Operatiivlogi (v\u00f5i Microsoft-Windows-PowerShellCore \/ Operatiiv PowerShell 6-s)<\/h4>\n<p>\n<img decoding=\"async\" alt=\"Mida kasulikku saab Windowsi operatsioonis\u00fcsteemiga t\u00f6\u00f6jaama logidest v\u00e4lja v\u00f5tta\" src=\"\/wp-content\/uploads\/2019\/04\/d0a1a74aad59c7c4f64446b52846429f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Moodulite logimine (s\u00fcndmuse ID 4103).<\/b> S\u00fcndmustes on talletatud teave igast t\u00e4idetud k\u00e4sust ja parameetritest, millega see kutsuti esile.<\/p>\n<p><b>Skriptide lukustamise logimine (s\u00fcndmuse ID 4104).<\/b> Skriptide lukustamise logimine n\u00e4itab iga t\u00e4idetud PowerShelli koodiploki. Isegi kui kurjategija \u00fcritab k\u00e4sku varjata, n\u00e4itab see s\u00fcndmus tegelikult t\u00e4idetud PowerShelli k\u00e4sku. Samuti v\u00f5ivad sellesse s\u00fcndmusesse olla fikseeritud m\u00f5ned madala taseme API-kutsed, mida tavaliselt salvestatakse Verbose'ina, kuid kui kahtlane k\u00e4sk v\u00f5i skript on koodiplokis, registreeritakse see kriitilisuse tasemel Warning.<\/p>\n<p>Pange t\u00e4hele, et p\u00e4rast selliste s\u00fcndmuste kogumise ja anal\u00fc\u00fcsimise t\u00f6\u00f6riista seadistamist on vajalik t\u00e4iendav aeg t\u00f5rkeotsinguks valeh\u00e4irete v\u00e4hendamiseks.<\/p>\n<p>Jagage kommentaarides, milliseid logisid te kogute infotehnoloogia auditi jaoks ja milliseid t\u00f6\u00f6riistu te selleks kasutate. \u00dcks meie suundi on andmete auditite lahendused. Logide kogumise ja anal\u00fc\u00fcsi \u00fclesande lahendamiseks saame soovitada vaadata <noindex><a rel=\"nofollow\" href=\"https:\/\/www.quest.com\/products\/intrust\/\">Quest InTrust<\/a><\/noindex>, mis suudab salvestatud andmeid tihendada koefitsiendiga 20:1, ja \u00fcks selle installeeritud eksemplar suudab t\u00f6\u00f6delda kuni 60000 s\u00fcndmust sekundis 10000 allikast.<br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/447522\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0439\u0442\u0438 \u043d\u0430 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u043f\u043e\u0447\u0442\u0443 \u043f\u0438\u0441\u044c\u043c\u043e \u0432\u0440\u043e\u0434\u0435 \u0431\u044b \u0438\u0437 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430, \u043d\u043e \u0441\u043e \u0441\u0441\u044b\u043b\u043a\u043e\u0439 \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0439 \u0441\u0430\u0439\u0442. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u043a\u0442\u043e-\u0442\u043e \u0441\u043a\u0430\u0447\u0430\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0443\u0442\u0438\u043b\u0438\u0442\u0443 \u0438\u0437 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u043a\u0430\u043a\u043e\u0433\u043e \u043c\u0435\u0441\u0442\u0430. \u0414\u0430 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u0438\u0434\u0443\u043c\u0430\u0442\u044c \u043d\u0435 \u043e\u0434\u0438\u043d \u0434\u0435\u0441\u044f\u0442\u043e\u043a \u043a\u0435\u0439\u0441\u043e\u0432, \u043a\u0430\u043a \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043c\u043e\u0436\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c\u0441\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23255,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31289","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0427\u0442\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0432\u044b\u0442\u0430\u0449\u0438\u0442\u044c \u0438\u0437 \u043b\u043e\u0433\u043e\u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0441\u0442\u0430\u043d\u0446\u0438\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 \u041e\u0421 Windows | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:40:29+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:40:29+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mida kasulikku saab Windowsi OS-i t\u00f6\u00f6jaama logidest v\u00e4lja tuua | ProHoster","description":"Kasutajate t\u00f6\u00f6jaam on k\u00f5ige haavatavam koht infotehnoloogia infrastruktuuris.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0442\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0432\u044b\u0442\u0430\u0449\u0438\u0442\u044c \u0438\u0437 \u043b\u043e\u0433\u043e\u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0441\u0442\u0430\u043d\u0446\u0438\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 \u041e\u0421 Windows | ProHoster","og:description":"\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:40:29+00:00","article:modified_time":"2019-10-31T18:40:29+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31289","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:25:31","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:19:49","updated":"2026-02-08 20:25:31","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/31289","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=31289"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/31289\/revisions"}],"predecessor-version":[{"id":157813,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/31289\/revisions\/157813"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/23255"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=31289"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=31289"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=31289"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}