{"id":31289,"date":"2019-10-31T21:40:29","date_gmt":"2019-10-31T18:40:29","guid":{"rendered":"https:\/\/prohoster.info\/blog\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows\/"},"modified":"2019-10-31T21:40:29","modified_gmt":"2019-10-31T18:40:29","slug":"chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","title":{"rendered":"\u010co u\u017eito\u010dn\u00e9 m\u00f4\u017eeme vy\u0165a\u017ei\u0165 z logov pracovnej stanice na b\u00e1ze OS Windows.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Pracovn\u00e1 stanica pou\u017e\u00edvate\u013ea je najzranite\u013enej\u0161\u00edm miestom infra\u0161trukt\u00fary z poh\u013eadu informa\u010dnej bezpe\u010dnosti. Pou\u017e\u00edvatelia m\u00f4\u017eu dost\u00e1va\u0165 na pracovn\u00fd e-mail spr\u00e1vy, ktor\u00e9 sa zdaj\u00fa by\u0165 z bezpe\u010dn\u00e9ho zdroja, ale obsahuj\u00fa odkazy na infikovan\u00e9 webov\u00e9 str\u00e1nky. M\u00f4\u017ee sa sta\u0165, \u017ee si niekto stiahne u\u017eito\u010dn\u00fa aplik\u00e1ciu z nezn\u00e1meho miesta. Mo\u017eno si predstavi\u0165 nieko\u013eko desiatok scen\u00e1rov, ako m\u00f4\u017ee \u0161kodliv\u00fd softv\u00e9r prenikn\u00fa\u0165 na intern\u00e9 firemn\u00e9 zdroje prostredn\u00edctvom pou\u017e\u00edvate\u013eov. Preto si pracovn\u00e9 stanice vy\u017eaduj\u00fa zv\u00fd\u0161en\u00fa pozornos\u0165, a v \u010dl\u00e1nku sa dozviete, odkia\u013e a ak\u00e9 udalosti sledova\u0165 na identifik\u00e1ciu \u00fatokov.<\/p>\n<p><img decoding=\"async\" alt=\"\u010co u\u017eito\u010dn\u00e9 m\u00f4\u017eeme vy\u0165a\u017ei\u0165 z logov pracovnej stanice na b\u00e1ze OS Windows.\" src=\"\/wp-content\/uploads\/2019\/04\/6e0eddfc90ae158b3d532a6b7a069177.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Na identifik\u00e1ciu \u00fatoku v \u010do najskor\u0161ej f\u00e1ze s\u00fa v opera\u010dnom syst\u00e9me Windows tri u\u017eito\u010dn\u00e9 zdroje udalost\u00ed: bezpe\u010dnostn\u00fd denn\u00edk udalost\u00ed, syst\u00e9mov\u00fd monitorovac\u00ed denn\u00edk a denn\u00edky Power Shell.<\/p>\n<h2>Bezpe\u010dnostn\u00fd denn\u00edk udalost\u00ed (Security Log)<\/h2>\n<p>\nToto je hlavn\u00e9 miesto na uchov\u00e1vanie syst\u00e9mov\u00fdch logov bezpe\u010dnosti. Ukladaj\u00fa sa sem udalosti prihl\u00e1senia\/odhl\u00e1senia pou\u017e\u00edvate\u013eov, pr\u00edstup k objektom, zmeny polit\u00edk a in\u00e9 aktivity s\u00favisiace s bezpe\u010dnos\u0165ou. Samozrejme, len ak je nastaven\u00e1 pr\u00edslu\u0161n\u00e1 politika.<\/p>\n<p><img decoding=\"async\" alt=\"\u010co u\u017eito\u010dn\u00e9 m\u00f4\u017eeme vy\u0165a\u017ei\u0165 z logov pracovnej stanice na b\u00e1ze OS Windows.\" src=\"\/wp-content\/uploads\/2019\/04\/82e59ad17a09a8211dc6fe9737208fd7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Preberanie pou\u017e\u00edvate\u013eov a skup\u00edn (udalosti 4798 a 4799).<\/b> \u0160kodliv\u00fd softv\u00e9r na za\u010diatku \u00fatoku \u010dasto preh\u013ead\u00e1va miestne u\u017e\u00edvate\u013esk\u00e9 \u00fa\u010dty a miestne skupiny na pracovnej stanici, aby na\u0161iel prihlasovacie \u00fadaje pre svoje nekal\u00e9 praktiky. Tieto udalosti pom\u00f4\u017eu odhali\u0165 \u0161kodliv\u00fd k\u00f3d sk\u00f4r, ne\u017e sa posunie \u010falej a, vyu\u017e\u00edvaj\u00fac z\u00edskan\u00e9 \u00fadaje, sa roz\u0161\u00edri na \u010fal\u0161ie syst\u00e9my.<\/p>\n<p><b>Vytvorenie miestneho \u00fa\u010dtu a zmeny v miestnych skupin\u00e1ch (udalosti 4720, 4722\u20134726, 4738, 4740, 4767, 4780, 4781, 4794, 5376 a 5377).<\/b> \u00datok m\u00f4\u017ee tie\u017e za\u010d\u00edna\u0165, napr\u00edklad, pridan\u00edm nov\u00e9ho pou\u017e\u00edvate\u013ea do skupiny miestnych administr\u00e1torov.<\/p>\n<p><b>Pokusy o prihl\u00e1senie s miestnym \u00fa\u010dtom (udalost 4624).<\/b> Poctiv\u00ed pou\u017e\u00edvatelia sa prihlasuj\u00fa s dom\u00e9nov\u00fdm \u00fa\u010dtom a zistenie prihl\u00e1senia pod miestnym \u00fa\u010dtom m\u00f4\u017ee znamena\u0165 za\u010diatok \u00fatoku. Udalos\u0165 4624 zah\u0155\u0148a aj prihl\u00e1senia pod dom\u00e9nov\u00fdm \u00fa\u010dtom, preto je potrebn\u00e9 pri spracovan\u00ed udalost\u00ed filtrova\u0165 tie, v ktor\u00fdch sa dom\u00e9na l\u00ed\u0161i od mena pracovnej stanice.<\/p>\n<p><b>Pok\u00fas o prihl\u00e1senie so zadan\u00fdm \u00fa\u010dtom (udalost 4648).<\/b> Toto sa st\u00e1va, ke\u010f je proces spusten\u00fd v re\u017eime \u201eSpustenie ako\u201c (run as). V norm\u00e1lnom pracovnom re\u017eime by sa to nemalo dia\u0165, tak\u017ee tak\u00e9to udalosti by mali by\u0165 pod kontrolou.<\/p>\n<p><b>Zamknutie\/odblokovanie pracovnej stanice (udalosti 4800-4803).<\/b> Medzi podozriv\u00e9 udalosti mo\u017eno zaradi\u0165 ak\u00e9ko\u013evek \u010dinnosti, ktor\u00e9 sa uskuto\u010dnili na zamknutej pracovnej stanici.<\/p>\n<p><b>Zmeny konfigur\u00e1cie firewallu (udalosti 4944-4958).<\/b> Je zrejm\u00e9, \u017ee pri in\u0161tal\u00e1cii nov\u00e9ho softv\u00e9ru sa m\u00f4\u017eu meni\u0165 nastavenia konfigur\u00e1cie firewallu, \u010do m\u00f4\u017ee sp\u00f4sobi\u0165 falo\u0161n\u00e9 poplachy. V\u00e4\u010d\u0161inou nie je potrebn\u00e9 kontrolova\u0165 tak\u00e9to zmeny, ale ur\u010dite nie je na \u0161kodu o nich vedie\u0165.<\/p>\n<p><b>Pripojenie zariaden\u00ed Plug\u2019n\u2019play (udalosti 6416 a iba pre Windows 10).<\/b> Na to je d\u00f4le\u017eit\u00e9 d\u00e1va\u0165 pozor, ak pou\u017e\u00edvatelia zvy\u010dajne nepripojuj\u00fa nov\u00e9 zariadenia k pracovnej stanici, a tu zrazu \u2014 pripojili.<\/p>\n<p>Windows obsahuje 9 kateg\u00f3ri\u00ed auditu a 50 subkateg\u00f3ri\u00ed na jemn\u00e9 nastavenie. Minim\u00e1lny s\u00fabor subkateg\u00f3ri\u00ed, ktor\u00fd stoj\u00ed za to aktivova\u0165 v nastaveniach:<\/p>\n<p><b>Prihl\u00e1senie\/odhl\u00e1senie<\/b><\/p>\n<ul>\n<li>Prihl\u00e1senie;<\/li>\n<li>Odhl\u00e1senie;<\/li>\n<li>Zamknutie \u00fa\u010dtu;<\/li>\n<li>In\u00e9 udalosti prihl\u00e1senia\/odhl\u00e1senia.<\/li>\n<\/ul>\n<p>\n<b>Spr\u00e1va \u00fa\u010dtov<\/b><\/p>\n<ul>\n<li>Spr\u00e1va pou\u017e\u00edvate\u013esk\u00fdch \u00fa\u010dtov;<\/li>\n<li>Spr\u00e1va bezpe\u010dnostn\u00fdch skup\u00edn.<\/li>\n<\/ul>\n<p>\n<b>Zmena politiky<\/b><\/p>\n<ul>\n<li>Zmena politiky auditu;<\/li>\n<li>Zmena politiky autentifik\u00e1cie;<\/li>\n<li>Zmena politiky autoriz\u00e1cie.<\/li>\n<\/ul>\n<p><\/p>\n<h2>Syst\u00e9mov\u00fd monitor (Sysmon)<\/h2>\n<p>\nSysmon je vstavan\u00fd n\u00e1stroj vo Windows, ktor\u00fd dok\u00e1\u017ee zaznamen\u00e1va\u0165 udalosti do syst\u00e9mov\u00e9ho denn\u00edka. Zvy\u010dajne je potrebn\u00e9 ho nain\u0161talova\u0165 osobitne.<\/p>\n<p><img decoding=\"async\" alt=\"\u010co u\u017eito\u010dn\u00e9 m\u00f4\u017eeme vy\u0165a\u017ei\u0165 z logov pracovnej stanice na b\u00e1ze OS Windows.\" src=\"\/wp-content\/uploads\/2019\/04\/0b1e14fb9ba4d63a4d9d94bd9d62d112.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTieto ist\u00e9 udalosti je v z\u00e1sade mo\u017en\u00e9 n\u00e1js\u0165 v denn\u00edku bezpe\u010dnosti (ak zapnete potrebn\u00fa politiku auditu), ale Sysmon poskytuje viac podrobnost\u00ed. Ak\u00e9 udalosti je mo\u017en\u00e9 z\u00edska\u0165 zo Sysmon?<\/p>\n<p><b>Vytvorenie procesu (ID udalosti 1).<\/b> Syst\u00e9mov\u00fd denn\u00edk udalost\u00ed zabezpe\u010denia tie\u017e m\u00f4\u017ee poveda\u0165, kedy sa spustil nejak\u00fd *.exe a dokonca uk\u00e1\u017ee jeho n\u00e1zov a cestu spustenia. Ale na rozdiel od Sysmon nem\u00f4\u017ee zobrazi\u0165 hash aplik\u00e1cie. Zlomyse\u013en\u00fd softv\u00e9r sa m\u00f4\u017ee naz\u00fdva\u0165 dokonca ne\u0161kodne notepad.exe, ale pr\u00e1ve hash ho odhal\u00ed.<\/p>\n<p><b>Sie\u0165ov\u00e9 pripojenia (ID udalosti 3).<\/b> Je zrejm\u00e9, \u017ee sie\u0165ov\u00fdch pripojen\u00ed je ve\u013ea a v\u0161etky sa nedaj\u00fa sledova\u0165. Ale je d\u00f4le\u017eit\u00e9 vzia\u0165 do \u00favahy, \u017ee Sysmon na rozdiel od toho ist\u00e9ho bezpe\u010dnostn\u00e9ho denn\u00edka dok\u00e1\u017ee priradi\u0165 sie\u0165ov\u00e9 pripojenie k poliam ProcessID a ProcessGUID, ukazuje port a <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sk\/lir\/ipv4\/\"   title=\"IP adresy\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"622\">IP adresy<\/a> zdroj a pr\u00edjemcu.<\/p>\n<p><b>Zmeny v syst\u00e9movom registri (ID udalosti 12-14).<\/b> Najjednoduch\u0161\u00ed sp\u00f4sob, ako sa prida\u0165 do automatick\u00e9ho spustenia, je zaregistrova\u0165 sa v registri. Security Log to vie, ale Sysmon uk\u00e1\u017ee, kto vykonal zmeny, kedy, odkia\u013e, ID procesu a predch\u00e1dzaj\u00facu hodnotu k\u013e\u00fa\u010da.<\/p>\n<p><b>Vytvorenie s\u00faboru (ID udalosti 11).<\/b> Sysmon, na rozdiel od Security Log, uk\u00e1\u017ee nielen umiestnenie s\u00faboru, ale aj jeho n\u00e1zov. Samozrejme, \u017ee v\u0161etko sa ned\u00e1 sledova\u0165, ale audit ur\u010dit\u00fdch adres\u00e1rov je mo\u017en\u00fd.<\/p>\n<p>A teraz to, \u010do v politik\u00e1ch Security Log nie je, ale v Sysmon je:<\/p>\n<p><b>Zmena \u010dasu vytvorenia s\u00faboru (ID udalosti 2).<\/b> Niektor\u00e9 malv\u00e9rov\u00e9 programy m\u00f4\u017eu meni\u0165 d\u00e1tum vytvorenia s\u00faboru, aby ho skryli z reportov s ned\u00e1vno vytvoren\u00fdmi s\u00fabormi.<\/p>\n<p><b>Na\u010d\u00edtanie ovl\u00e1da\u010dov a dynamick\u00fdch kni\u017en\u00edc (ID udalost\u00ed 6-7).<\/b> Sledovanie na\u010d\u00edtania v pam\u00e4ti DLL a ovl\u00e1da\u010dov zariaden\u00ed, kontrola digit\u00e1lneho podpisu a jeho platnosti.<\/p>\n<p><b>Vytvorenie vl\u00e1kna v be\u017eiacom procese (ID udalosti 8).<\/b> Jedna z foriem \u00fatoku, na ktor\u00fa je potrebn\u00e9 d\u00e1va\u0165 pozor.<\/p>\n<p><b>Udalosti RawAccessRead (ID udalosti 9).<\/b> Oper\u00e1cie \u010d\u00edtania z disku pomocou \u201c.\u201d. Vo v\u00e4\u010d\u0161ine pr\u00edpadov by sa tak\u00e1 aktivita mala pova\u017eova\u0165 za nenorm\u00e1lnu.<\/p>\n<p><b>Vytvorenie pomenovanej s\u00faborovej streamy (ID udalosti 15).<\/b> Udalos\u0165 sa registruje, ke\u010f sa vytvor\u00ed pomenovan\u00e1 s\u00faborov\u00e1 stream, ktor\u00e1 generuje udalosti s hashom obsahu s\u00faboru.<\/p>\n<p><b>Vytvorenie named pipe a pripojenia (ID udalost\u00ed 17-18).<\/b> Sledovanie \u0161kodliv\u00e9ho k\u00f3du, ktor\u00fd komunikuje s in\u00fdmi komponentmi cez named pipe.<\/p>\n<p><b>Aktivity WMI (ID udalosti 19).<\/b> Registr\u00e1cia udalost\u00ed, ktor\u00e9 sa generuj\u00fa pri pr\u00edstupe k syst\u00e9mu prostredn\u00edctvom protokolu WMI.<\/p>\n<p>Na ochranu samotn\u00e9ho Sysmon je potrebn\u00e9 sledova\u0165 udalosti s ID 4 (zastavenie a spustenie Sysmon) a ID 16 (zmena konfigur\u00e1cie Sysmon).<\/p>\n<h2>\u017durn\u00e1ly Power Shell<\/h2>\n<p>\nPower Shell je mocn\u00fd n\u00e1stroj na spr\u00e1vu infra\u0161trukt\u00fary Windows, preto s\u00fa \u0161ance, \u017ee \u00fato\u010dn\u00edk si vyberie pr\u00e1ve jeho. Na z\u00edskanie \u00fadajov o udalostiach Power Shell m\u00f4\u017eete pou\u017ei\u0165 dva zdroje: Windows PowerShell log a Microsoft-WindowsPowerShell \/ Operational log.<\/p>\n<h4>Windows PowerShell log<\/h4>\n<p>\n<img decoding=\"async\" alt=\"\u010co u\u017eito\u010dn\u00e9 m\u00f4\u017eeme vy\u0165a\u017ei\u0165 z logov pracovnej stanice na b\u00e1ze OS Windows.\" src=\"\/wp-content\/uploads\/2019\/04\/03d830871fc2c47ceeb8f0822f3f20e0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Na\u010d\u00edtan\u00fd poskytovate\u013e \u00fadajov (ID udalosti 600).<\/b> Poskytovatelia PowerShell s\u00fa programy, ktor\u00e9 sl\u00fa\u017eia ako zdroj d\u00e1t pre PowerShell na ich prezeranie a spr\u00e1vu. Napr\u00edklad medzi vstavan\u00fdmi poskytovate\u013emi m\u00f4\u017eu by\u0165 syst\u00e9mov\u00e9 premenn\u00e9 Windows alebo syst\u00e9mov\u00fd register. Je potrebn\u00e9 sledova\u0165 vznik nov\u00fdch poskytovate\u013eov, aby sa v\u010das odhalila nebezpe\u010dn\u00e1 aktivita. Napr\u00edklad ak vid\u00edte, \u017ee medzi poskytovate\u013emi sa objavil WSMan, znamen\u00e1 to, \u017ee bol zah\u00e1jen\u00fd vzdialen\u00fd PowerShell seans.<\/p>\n<h4>Microsoft-WindowsPowerShell \/ Opera\u010dn\u00fd denn\u00edk (alebo MicrosoftWindows-PowerShellCore \/ Opera\u010dn\u00fd v PowerShell 6)<\/h4>\n<p>\n<img decoding=\"async\" alt=\"\u010co u\u017eito\u010dn\u00e9 m\u00f4\u017eeme vy\u0165a\u017ei\u0165 z logov pracovnej stanice na b\u00e1ze OS Windows.\" src=\"\/wp-content\/uploads\/2019\/04\/d0a1a74aad59c7c4f64446b52846429f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Zaznamen\u00e1vanie modulov (ID udalosti 4103).<\/b> V udalostiach s\u00fa ulo\u017een\u00e9 inform\u00e1cie o ka\u017ed\u00e9mu vykonan\u00e9mu pr\u00edkazu a parametroch, s ktor\u00fdmi bol vyvolan\u00fd.<\/p>\n<p><b>Zaznamen\u00e1vanie blokovania skriptov (ID udalosti 4104).<\/b> Zaznamen\u00e1vanie blokovania skriptov ukazuje ka\u017ed\u00fd vykonan\u00fd blok k\u00f3du PowerShell. Aj ke\u010f sa \u00fato\u010dn\u00edk pok\u00fasi skry\u0165 pr\u00edkaz, tento typ udalosti zobraz\u00ed skuto\u010dne vykonan\u00fd pr\u00edkaz PowerShell. E\u0161te v tomto type udalosti m\u00f4\u017eu by\u0165 zaznamenan\u00e9 niektor\u00e9 vykon\u00e1van\u00e9 n\u00edzko\u00farov\u0148ov\u00e9 volania API, tieto udalosti sa zvy\u010dajne zapisuj\u00fa ako Verbose, ale ak sa v bloku k\u00f3du pou\u017eije podozriv\u00fd pr\u00edkaz alebo skript, bude registrovan\u00fd ako s kritickos\u0165ou Warning.<\/p>\n<p>V\u0161imnite si, \u017ee po nastaven\u00ed n\u00e1stroja na zber a anal\u00fdzu t\u00fdchto udalost\u00ed bude potrebn\u00fd \u010fal\u0161\u00ed \u010das na ladenie na zn\u00ed\u017eenie po\u010dtu falo\u0161n\u00fdch poplachov.<\/p>\n<p>Pode\u013ete sa v koment\u00e1roch o to, ak\u00e9 logy zbierate pre audit informa\u010dnej bezpe\u010dnosti a ak\u00e9 n\u00e1stroje na to pou\u017e\u00edvate. Jedn\u00fdm z na\u0161ich zameran\u00ed s\u00fa rie\u0161enia na audit udalost\u00ed informa\u010dnej bezpe\u010dnosti. Pre rie\u0161enie \u00falohy zberu a anal\u00fdzy logov v\u00e1m m\u00f4\u017eeme odporu\u010di\u0165 pozrie\u0165 sa na <noindex><a rel=\"nofollow\" href=\"https:\/\/www.quest.com\/products\/intrust\/\">Quest InTrust<\/a><\/noindex>, ktor\u00fd dok\u00e1\u017ee komprimova\u0165 ulo\u017een\u00e9 d\u00e1ta s pomerom 20:1, a jeden jeho nain\u0161talovan\u00fd exempl\u00e1r dok\u00e1\u017ee spracova\u0165 a\u017e 60000 udalost\u00ed za sekundu z 10000 zdrojov.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/447522\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0439\u0442\u0438 \u043d\u0430 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u043f\u043e\u0447\u0442\u0443 \u043f\u0438\u0441\u044c\u043c\u043e \u0432\u0440\u043e\u0434\u0435 \u0431\u044b \u0438\u0437 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430, \u043d\u043e \u0441\u043e \u0441\u0441\u044b\u043b\u043a\u043e\u0439 \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0439 \u0441\u0430\u0439\u0442. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u043a\u0442\u043e-\u0442\u043e \u0441\u043a\u0430\u0447\u0430\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0443\u0442\u0438\u043b\u0438\u0442\u0443 \u0438\u0437 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u043a\u0430\u043a\u043e\u0433\u043e \u043c\u0435\u0441\u0442\u0430. \u0414\u0430 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u0438\u0434\u0443\u043c\u0430\u0442\u044c \u043d\u0435 \u043e\u0434\u0438\u043d \u0434\u0435\u0441\u044f\u0442\u043e\u043a \u043a\u0435\u0439\u0441\u043e\u0432, \u043a\u0430\u043a \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043c\u043e\u0436\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c\u0441\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23255,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31289","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0427\u0442\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0432\u044b\u0442\u0430\u0449\u0438\u0442\u044c \u0438\u0437 \u043b\u043e\u0433\u043e\u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0441\u0442\u0430\u043d\u0446\u0438\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 \u041e\u0421 Windows | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:40:29+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:40:29+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u010co u\u017eito\u010dn\u00e9 sa d\u00e1 z\u00edska\u0165 z logov pracovnej stanice na b\u00e1ze OS Windows | ProHoster","description":"Pou\u017e\u00edvate\u013esk\u00e1 pracovn\u00e1 stanica je najzranite\u013enej\u0161ie miesto infra\u0161trukt\u00fary z poh\u013eadu informa\u010dnej bezpe\u010dnosti.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0442\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0432\u044b\u0442\u0430\u0449\u0438\u0442\u044c \u0438\u0437 \u043b\u043e\u0433\u043e\u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0441\u0442\u0430\u043d\u0446\u0438\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 \u041e\u0421 Windows | ProHoster","og:description":"\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:40:29+00:00","article:modified_time":"2019-10-31T18:40:29+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31289","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:25:31","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:19:49","updated":"2026-02-08 20:25:31","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31289","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=31289"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31289\/revisions"}],"predecessor-version":[{"id":157813,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31289\/revisions\/157813"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/23255"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=31289"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=31289"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=31289"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}