{"id":31289,"date":"2019-10-31T21:40:29","date_gmt":"2019-10-31T18:40:29","guid":{"rendered":"https:\/\/prohoster.info\/blog\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows\/"},"modified":"2019-10-31T21:40:29","modified_gmt":"2019-10-31T18:40:29","slug":"chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","title":{"rendered":"Mida kasulikku saab Windows operatsioonis\u00fcsteemiga t\u00f6\u00f6jaama logidest v\u00e4lja tuua","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Kasutaja t\u00f6\u00f6jaam on infrastruktuuri k\u00f5ige haavatavam koht infotehnoloogia turvalisuse osas. Kasutajatele v\u00f5ib tulla t\u00f6\u00f6meil, mis n\u00e4ib olevat ohutust allikast, kuid sisaldab linki nakatunud saidile. V\u00f5imalik, et keegi laadib alla t\u00f6\u00f6ks vajaliku t\u00f6\u00f6riista tundmatust kohast. Saaksime v\u00e4lja m\u00f5elda hulga juhtumeid, kuidas pahavara v\u00f5ib kasutajate kaudu tungida sisekorporatiivsetesse ressurssidesse. Seet\u00f5ttu vajavad t\u00f6\u00f6jaamad suurenenud t\u00e4helepanu, ja selles artiklis r\u00e4\u00e4gime, kust ja milliseid s\u00fcndmusi j\u00e4lgida r\u00fcnnakute tuvastamiseks.<\/p>\n<p><img decoding=\"async\" alt=\"Mida kasulikku saab Windows operatsioonis\u00fcsteemiga t\u00f6\u00f6jaama logidest v\u00e4lja tuua\" src=\"\/wp-content\/uploads\/2019\/04\/6e0eddfc90ae158b3d532a6b7a069177.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>R\u00fcnnaku varajaseks tuvastamiseks on Windowsi operatsioonis\u00fcsteemis kolm kasulikku s\u00fcndmuste allikat: turvalogide ajakiri, s\u00fcsteemimonitooringu ajakiri ja Power Shelli logid.<\/p>\n<h2>Turvalogide ajakiri (Security Log)<\/h2>\n<p>\nSee on peamine koht s\u00fcsteemsete turvalogide talletamiseks. Siia salvestatakse kasutajate sisselogimise\/v\u00e4ljalogimise s\u00fcndmused, objektide juurde p\u00e4\u00e4semine, poliitikate muutmine ja muud turvalisusega seotud tegevused. Loomulikult, kui on seadistatud vastav poliitika.<\/p>\n<p><img decoding=\"async\" alt=\"Mida kasulikku saab Windows operatsioonis\u00fcsteemiga t\u00f6\u00f6jaama logidest v\u00e4lja tuua\" src=\"\/wp-content\/uploads\/2019\/04\/82e59ad17a09a8211dc6fe9737208fd7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Kasutajate ja r\u00fchmade l\u00e4bivaatamine (s\u00fcndmused 4798 ja 4799).<\/b> Kahjulik tarkvara alustab oma r\u00fcnnakut sageli kohalike kasutajakontode ja kohalike gruppide skaneerimisega t\u00f6\u00f6jaamas, et leida oma tumedate tegude jaoks vajalikke isikuandmeid. Need s\u00fcndmused aitavad tuvastada kahjulikku koodi enne, kui see edasi liikuda ja kogutud andmeid kasutades teistesse s\u00fcsteemidesse levivad.<\/p>\n<p><b>Kohaliku kasutajakonto loomine ja muudatused kohalikes gruppides (s\u00fcndmused 4720, 4722\u20134726, 4738, 4740, 4767, 4780, 4781, 4794, 5376 ja 5377).<\/b> R\u00fcnnak v\u00f5ib alata ka n\u00e4iteks uue kasutaja lisamisest kohalike administraatorite gruppi.<\/p>\n<p><b>Kohaliku kasutajakontoga sisselogimise katsed (s\u00fcndmus 4624).<\/b> Ahned kasutajad logivad sisse domeeni konto kaudu, ja kohaliku konto kaudu sisselogimise tuvastamine v\u00f5ib viidata r\u00fcnnaku algusele. S\u00fcndmus 4624 h\u00f5lmab ka sisselogimisi domeeni konto kaudu, seega s\u00fcndmuste t\u00f6\u00f6tlemisel tuleb filtreerida v\u00e4lja need s\u00fcndmused, kus domeen erineb t\u00f6\u00f6jaama nimest.<\/p>\n<p><b>Sisselogimise katse m\u00e4\u00e4ratud kasutajakontoga (s\u00fcndmus 4648).<\/b> See juhtub, kui protsess t\u00f6\u00f6tab \"K\u00e4ivitamine administraatorina\" re\u017eiimis. Tavalistes s\u00fcsteemi t\u00f6\u00f6re\u017eiimides ei tohiks seda juhtuda, seega peaksid sellised s\u00fcndmused olema kontrolli all.<\/p>\n<p><b>T\u00f6\u00f6kohaga seotud jaamade lukustamine\/\u00fcmberlukustamine (s\u00fcndmused 4800-4803).<\/b> Kahtlaste s\u00fcndmuste kategooriasse kuuluvad k\u00f5ik tegevused, mis toimusid lukustatud jaamas.<\/p>\n<p><b>Tulekahju seina konfiguratsiooni muudatused (s\u00fcndmused 4944-4958).<\/b> Selgelt on n\u00e4htav, et uue tarkvara installimisel v\u00f5ivad tulekahju seina konfiguratsiooni seaded muutuda, mis p\u00f5hjustab valeh\u00e4ireid. Selliste muudatuste j\u00e4lgimine on enamikul juhtudel mitte vajalik, kuid teadlikkus neist ei ole kindlasti \u00fcleliigne.<\/p>\n<p><b>Plug\u2019n\u2019play seadmete \u00fchendamine (s\u00fcndmus 6416 ja ainult Windows 10 jaoks).<\/b> Selle eest on oluline j\u00e4lgida, kui kasutajad tavaliselt ei \u00fchenda uusi seadmeid t\u00f6\u00f6kohaga, kuid n\u00fc\u00fcd \u00e4kitselt \u2014 ja \u00fchendavad.<\/p>\n<p>Windows sisaldab 9 audiitorkategooriat ja 50 alamkategooriat t\u00e4pseks seadistamiseks. Miinimumkomplekt alamkategooriatest, mille tuleks seadetes sisse l\u00fclitada:<\/p>\n<p><b>Sisselogimine\/Sisselogimise l\u00f5petamine<\/b><\/p>\n<ul>\n<li>Sisselogimine;<\/li>\n<li>Sisselogimise l\u00f5petamine;<\/li>\n<li>Konto lukustamine;<\/li>\n<li>Teised sisselogimise\/sisselogimise l\u00f5petamise s\u00fcndmused.<\/li>\n<\/ul>\n<p>\n<b>Konto haldamine<\/b><\/p>\n<ul>\n<li>Kasutajakonto haldamine;<\/li>\n<li>Turvagruppide haldamine.<\/li>\n<\/ul>\n<p>\n<b>Poliitika muutmine<\/b><\/p>\n<ul>\n<li>Auditipoliitika muutmine;<\/li>\n<li>Autentimise poliitika muudatus;<\/li>\n<li>Autoriseerimise poliitika muudatus.<\/li>\n<\/ul>\n<p><\/p>\n<h2>S\u00fcsteemi monitor (Sysmon)<\/h2>\n<p>\nSysmon on Windows'i sisseehitatud utiliit, mis suudab salvestada s\u00fcndmusi s\u00fcsteemilogisse. Tavaliselt tuleb see eraldi installida.<\/p>\n<p><img decoding=\"async\" alt=\"Mida kasulikku saab Windows operatsioonis\u00fcsteemiga t\u00f6\u00f6jaama logidest v\u00e4lja tuua\" src=\"\/wp-content\/uploads\/2019\/04\/0b1e14fb9ba4d63a4d9d94bd9d62d112.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNeed s\u00fcndmused on p\u00f5him\u00f5tteliselt leitavad ka turvap\u00e4evikust (kui vajalik auditipoliitika on sisse l\u00fclitatud), kuid Sysmon pakub rohkem \u00fcksikasju. Milliseid s\u00fcndmusi saab Sysmonist hankida?<\/p>\n<p><b>Protsessi loomine (s\u00fcndmuse ID 1).<\/b> S\u00fcsteemilogis v\u00f5ib turvap\u00e4evik samuti \u00f6elda, millal k\u00e4ivitus m\u00f5ni *.exe ja isegi n\u00e4idata selle nime ja k\u00e4ivitusteed. Kuid erinevalt Sysmonist ei suuda see n\u00e4idata rakenduse ristit. Pahalase tarkvara v\u00f5ib nimetada ka t\u00e4iesti kahjutuks notepad.exe, kuid just ristit paljastab selle t\u00f5elise olemuse.<\/p>\n<p><b>V\u00f5rgupoodid (s\u00fcndmuse ID 3).<\/b> On selge, et v\u00f5rgupoodide arv on suur ja k\u00f5iki ei suuda j\u00e4lgida. Kuid on oluline arvestada, et Sysmon, erinevalt n\u00e4iteks turvalisuse logidest, suudab siduda v\u00f5rgu\u00fchenduse ProcessID ja ProcessGUID v\u00e4ljadega, n\u00e4idates porti ja <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/lir\/ipv4\/\"   title=\"IP-aadressid\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"622\">IP-aadressid<\/a> allikaid ning vastuv\u00f5tjat.<\/p>\n<p><b>Muutused s\u00fcsteemiregistris (s\u00fcndmuse ID 12-14).<\/b> Lihtsaim viis enda lisamiseks automaatse k\u00e4ivituse on registreerimisandmete sisestamine. Security Log oskab seda teha, kuid Sysmon n\u00e4itab, kes muudatusi tegi, millal, kust, protsessi ID ja eelmine v\u00f5tme v\u00e4\u00e4rtus.<\/p>\n<p><b>Faili loomine (s\u00fcndmuse ID 11).<\/b> Sysmon, erinevalt Security Log'ist, n\u00e4itab mitte ainult faili asukohta, vaid ka selle nime. On selge, et k\u00f5ike ei saa j\u00e4lgida, kuid teatud kataloogide auditeerimist on v\u00f5imalik teostada.<\/p>\n<p>Ja n\u00fc\u00fcd see, mida Security Log poliitikates ei ole, kuid Sysmon'is on:<\/p>\n<p><b>Faili loomise aja muutmine (s\u00fcndmuse ID 2).<\/b> M\u00f5ned pahavara v\u00f5ivad failide loomise kuup\u00e4eva muuta, et neid varjata hiljuti loodud failide aruannetest.<\/p>\n<p><b>Draiverite ja d\u00fcnaamiliste raamatukogude laadimine (s\u00fcndmuste ID 6-7).<\/b> DLL ja seadmete draiverite m\u00e4lu laadimist, digitaalallkirja kontrollimist ja selle kehtivust.<\/p>\n<p><b>Jooksvasse protsessi l\u00f5ime loomine (s\u00fcndmuse ID 8).<\/b> \u00dcks r\u00fcnnaku vormidest, mida peab j\u00e4lgima.<\/p>\n<p><b>RawAccessRead s\u00fcndmused (s\u00fcndmuse ID 9).<\/b> Lugemisoperatsioonid kettalt kasutades \".\". Enamiku juhtude puhul tuleks sellist aktiivsust pidada ebanormaalseks.<\/p>\n<p><b>Nimega failivoogude loomine (s\u00fcndmuse ID 15).<\/b> S\u00fcndmus registreeritakse, kui luuakse nimetatud faili voog, mis genereerib s\u00fcndmusi faili sisu r\u00e4siga.<\/p>\n<p><b>Nimetatud voolu loomine ja \u00fchendamine (s\u00fcndmuse ID 17-18).<\/b> Troojalaste j\u00e4lgimine, mis suhtlevad teiste komponentidega nimetatud voolu kaudu.<\/p>\n<p><b>WMI tegevus (s\u00fcndmuse ID 19).<\/b> S\u00fcndmuste registreerimine, mis genereeritakse s\u00fcsteemi poole p\u00f6\u00f6rdumisel WMI protokolli kaudu.<\/p>\n<p>Sysmoni kaitsmiseks tuleb j\u00e4lgida s\u00fcndmusi ID 4 (Sysmoni l\u00f5petamine ja k\u00e4ivitamine) ja ID 16 (Sysmoni konfiguratsiooni muutmine).<\/p>\n<h2>PowerShelli logid<\/h2>\n<p>\nPowerShell on v\u00f5imas Windowsi infrastruktuuri haldamise t\u00f6\u00f6riist, seega on suur t\u00f5en\u00e4osus, et r\u00fcndaja valib just selle. PowerShelli s\u00fcndmuste andmete saamiseks saab kasutada kahte allikat: Windows PowerShelli logi ja Microsoft-WindowsPowerShell \/ Operational logi.<\/p>\n<h4>Windows PowerShelli logi<\/h4>\n<p>\n<img decoding=\"async\" alt=\"Mida kasulikku saab Windows operatsioonis\u00fcsteemiga t\u00f6\u00f6jaama logidest v\u00e4lja tuua\" src=\"\/wp-content\/uploads\/2019\/04\/03d830871fc2c47ceeb8f0822f3f20e0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Andmete pakkuja on laaditud (s\u00fcndmuse ID 600).<\/b> PowerShelli pakkujad on programmid, mis toimivad andmeallikana PowerShelli jaoks andmete vaatamiseks ja haldamiseks. N\u00e4iteks v\u00f5ivad sisseehitatud pakkujatena olla Windowsi keskkonnamuutujad v\u00f5i s\u00fcsteemi register. Uute pakkujate ilmumise j\u00e4lgimine on oluline, et tuvastada v\u00f5imalikke kuritegelikke tegevusi. Kui m\u00e4rkate, et pakkujate seas on ilmunud WSMan, t\u00e4hendab see, et kaugsessioon PowerShellis on alustatud.<\/p>\n<h4>Microsoft-WindowsPowerShell \/ T\u00f6\u00f6k\u00e4sk (v\u00f5i MicrosoftWindows-PowerShellCore \/ T\u00f6\u00f6k\u00e4sk PowerShellis 6)<\/h4>\n<p>\n<img decoding=\"async\" alt=\"Mida kasulikku saab Windows operatsioonis\u00fcsteemiga t\u00f6\u00f6jaama logidest v\u00e4lja tuua\" src=\"\/wp-content\/uploads\/2019\/04\/d0a1a74aad59c7c4f64446b52846429f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Moodulite logimine (s\u00fcndmuse ID 4103).<\/b> S\u00fcndmustes salvestatakse teave iga t\u00e4idetud k\u00e4su ja selle parameetrite kohta, millega see k\u00e4idi.<\/p>\n<p><b>K\u00e4suskriptide logimine (s\u00fcndmuse ID 4104).<\/b> Skripti logimise jurnal n\u00e4itab iga PowerShelli koodi ploki t\u00e4itmist. Isegi kui r\u00fcndaja \u00fcritab k\u00e4sku varjata, n\u00e4itab see s\u00fcndmuste t\u00fc\u00fcp tegelikult t\u00e4idetud PowerShelli k\u00e4sku. Selle s\u00fcndmuste t\u00fc\u00fcbi alla v\u00f5ivad registreeritud olla ka m\u00f5ned madala taseme API kutsed, need s\u00fcndmused registreeritakse tavaliselt Verbose'i kujul, kuid kui v\u00e4himatki kahtlust tekitav k\u00e4sk v\u00f5i skript kasutatakse koodiplokis, registreeritakse see kriitilisuse tasemega Warning.<\/p>\n<p>Pange t\u00e4hele, et p\u00e4rast selle s\u00fcndmuste kogumise ja anal\u00fc\u00fcsi t\u00f6\u00f6riista seadistamist kulub valeh\u00e4irete arvu v\u00e4hendamiseks t\u00e4iendavat aega t\u00f5rkeotsimiseks.<\/p>\n<p>Jagage kommentaarides, milliseid logisid te kogute infotehnoloogia auditi jaoks ja milliseid t\u00f6\u00f6riistu selleks kasutate. \u00dcks meie suundi on infoturbe s\u00fcndmuste auditeerimise lahendused. Logide kogumise ja anal\u00fc\u00fcsi \u00fclesande jaoks v\u00f5ime soovitada vaadata <noindex><a rel=\"nofollow\" href=\"https:\/\/www.quest.com\/products\/intrust\/\">Quest InTrust<\/a><\/noindex>, mis suudab salvestatud andmeid tihendada suhtega 20:1 ning \u00fcks installeeritud eksemplar suudab t\u00f6\u00f6deldud kuni 60 000 s\u00fcndmust sekundis 10 000 allikast.<br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/447522\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0439\u0442\u0438 \u043d\u0430 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u043f\u043e\u0447\u0442\u0443 \u043f\u0438\u0441\u044c\u043c\u043e \u0432\u0440\u043e\u0434\u0435 \u0431\u044b \u0438\u0437 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430, \u043d\u043e \u0441\u043e \u0441\u0441\u044b\u043b\u043a\u043e\u0439 \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0439 \u0441\u0430\u0439\u0442. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u043a\u0442\u043e-\u0442\u043e \u0441\u043a\u0430\u0447\u0430\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0443\u0442\u0438\u043b\u0438\u0442\u0443 \u0438\u0437 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u043a\u0430\u043a\u043e\u0433\u043e \u043c\u0435\u0441\u0442\u0430. \u0414\u0430 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u0438\u0434\u0443\u043c\u0430\u0442\u044c \u043d\u0435 \u043e\u0434\u0438\u043d \u0434\u0435\u0441\u044f\u0442\u043e\u043a \u043a\u0435\u0439\u0441\u043e\u0432, \u043a\u0430\u043a \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043c\u043e\u0436\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c\u0441\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23255,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31289","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0439\u0442\u0438 \u043d\u0430 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u043f\u043e\u0447\u0442\u0443 \u043f\u0438\u0441\u044c\u043c\u043e \u0432\u0440\u043e\u0434\u0435 \u0431\u044b \u0438\u0437 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430, \u043d\u043e \u0441\u043e \u0441\u0441\u044b\u043b\u043a\u043e\u0439 \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0439 \u0441\u0430\u0439\u0442. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u043a\u0442\u043e-\u0442\u043e \u0441\u043a\u0430\u0447\u0430\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0443\u0442\u0438\u043b\u0438\u0442\u0443 \u0438\u0437 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u043a\u0430\u043a\u043e\u0433\u043e \u043c\u0435\u0441\u0442\u0430. \u0414\u0430 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u0438\u0434\u0443\u043c\u0430\u0442\u044c \u043d\u0435 \u043e\u0434\u0438\u043d \u0434\u0435\u0441\u044f\u0442\u043e\u043a \u043a\u0435\u0439\u0441\u043e\u0432, \u043a\u0430\u043a \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043c\u043e\u0436\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c\u0441\u044f\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0427\u0442\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0432\u044b\u0442\u0430\u0449\u0438\u0442\u044c \u0438\u0437 \u043b\u043e\u0433\u043e\u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0441\u0442\u0430\u043d\u0446\u0438\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 \u041e\u0421 Windows | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0439\u0442\u0438 \u043d\u0430 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u043f\u043e\u0447\u0442\u0443 \u043f\u0438\u0441\u044c\u043c\u043e \u0432\u0440\u043e\u0434\u0435 \u0431\u044b \u0438\u0437 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430, \u043d\u043e \u0441\u043e \u0441\u0441\u044b\u043b\u043a\u043e\u0439 \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0439 \u0441\u0430\u0439\u0442. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u043a\u0442\u043e-\u0442\u043e \u0441\u043a\u0430\u0447\u0430\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0443\u0442\u0438\u043b\u0438\u0442\u0443 \u0438\u0437 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u043a\u0430\u043a\u043e\u0433\u043e \u043c\u0435\u0441\u0442\u0430. \u0414\u0430 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u0438\u0434\u0443\u043c\u0430\u0442\u044c \u043d\u0435 \u043e\u0434\u0438\u043d \u0434\u0435\u0441\u044f\u0442\u043e\u043a \u043a\u0435\u0439\u0441\u043e\u0432, \u043a\u0430\u043a \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043c\u043e\u0436\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c\u0441\u044f\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:40:29+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:40:29+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mida kasulikku saab Windowsi ops\u00fcsteemiga t\u00f6\u00f6jaama logidest v\u00e4lja v\u00f5tta | ProHoster","description":"Kasutajate t\u00f6\u00f6jaam on infrastruktuuri k\u00f5ige haavatavam koht teabe turvalisuse osas. Kasutajatele v\u00f5ib tulla t\u00f6\u00f6meil tundlikust allikast, kuid lingiga nakatunud veebisaidile. V\u00f5imalik, et keegi laadib alla t\u00f6\u00f6ks kasuliku rakenduse m\u00f5nest tundmatust kohast. Saame v\u00e4lja m\u00f5elda mitte \u00fche, vaid k\u00fcmneid juhtumeid, kuidas kasutajate kaudu v\u00f5ib pahavara sisse tungida.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0442\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0432\u044b\u0442\u0430\u0449\u0438\u0442\u044c \u0438\u0437 \u043b\u043e\u0433\u043e\u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0441\u0442\u0430\u043d\u0446\u0438\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 \u041e\u0421 Windows | ProHoster","og:description":"\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0439\u0442\u0438 \u043d\u0430 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u043f\u043e\u0447\u0442\u0443 \u043f\u0438\u0441\u044c\u043c\u043e \u0432\u0440\u043e\u0434\u0435 \u0431\u044b \u0438\u0437 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430, \u043d\u043e \u0441\u043e \u0441\u0441\u044b\u043b\u043a\u043e\u0439 \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0439 \u0441\u0430\u0439\u0442. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u043a\u0442\u043e-\u0442\u043e \u0441\u043a\u0430\u0447\u0430\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0443\u0442\u0438\u043b\u0438\u0442\u0443 \u0438\u0437 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u043a\u0430\u043a\u043e\u0433\u043e \u043c\u0435\u0441\u0442\u0430. \u0414\u0430 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u0438\u0434\u0443\u043c\u0430\u0442\u044c \u043d\u0435 \u043e\u0434\u0438\u043d \u0434\u0435\u0441\u044f\u0442\u043e\u043a \u043a\u0435\u0439\u0441\u043e\u0432, \u043a\u0430\u043a \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043c\u043e\u0436\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c\u0441\u044f","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:40:29+00:00","article:modified_time":"2019-10-31T18:40:29+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31289","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:25:31","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:19:49","updated":"2026-02-08 20:25:31"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/31289","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=31289"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/31289\/revisions"}],"predecessor-version":[{"id":157813,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/31289\/revisions\/157813"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/23255"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=31289"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=31289"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=31289"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}