{"id":31289,"date":"2019-10-31T21:40:29","date_gmt":"2019-10-31T18:40:29","guid":{"rendered":"https:\/\/prohoster.info\/blog\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows\/"},"modified":"2019-10-31T21:40:29","modified_gmt":"2019-10-31T18:40:29","slug":"chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","title":{"rendered":"\u00c7far\u00eb t\u00eb dobishme mund t\u00eb nxjerrim nga log-et e stacionit t\u00eb pun\u00ebs me OS Windows","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Stacioni i pun\u00ebs s\u00eb p\u00ebrdoruesve \u00ebsht\u00eb pika m\u00eb e dob\u00ebt e infrastruktur\u00ebs n\u00eb aspektin e siguris\u00eb informacionit. P\u00ebrdoruesit mund t\u00eb marrin n\u00eb kutin\u00eb e tyre t\u00eb post\u00ebs elektronike nj\u00eb mesazh q\u00eb duket se vjen nga nj\u00eb burim i sigurt, por p\u00ebrmban lidhje me nj\u00eb faqe t\u00eb infektuar. Mund t\u00eb ndodhi q\u00eb dikush t\u00eb shkarkoj\u00eb nj\u00eb mjet t\u00eb dobish\u00ebm p\u00ebr pun\u00eb nga nj\u00eb burim t\u00eb panjohur. Mund t\u00eb imagjinohet me dhjet\u00ebra raste se si malware mund t\u00eb futet n\u00eb burimet brenda-korporat\u00eb p\u00ebrmes p\u00ebrdoruesve. Prandaj, stacionet e pun\u00ebs k\u00ebrkojn\u00eb v\u00ebmendje t\u00eb shtuar, dhe n\u00eb k\u00ebt\u00eb artikull ne do t\u00eb flasim p\u00ebr burimet dhe shoq\u00ebrimet q\u00eb duhen ndjekur p\u00ebr t\u00eb monitoruar sulmet.<\/p>\n<p><img decoding=\"async\" alt=\"\u00c7far\u00eb t\u00eb dobishme mund t\u00eb nxjerrim nga log-et e stacionit t\u00eb pun\u00ebs me OS Windows\" src=\"\/wp-content\/uploads\/2019\/04\/6e0eddfc90ae158b3d532a6b7a069177.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>P\u00ebr identifikimin e sulmeve n\u00eb fazat m\u00eb t\u00eb hershme, n\u00eb sistemin operativ Windows ka tri burime t\u00eb dobishme ngjarjesh: regjistri i ngjarjeve t\u00eb siguris\u00eb, regjistri i monitorimit t\u00eb sistemit dhe regjistrat e Power Shell.<\/p>\n<h2>Regjistri i ngjarjeve t\u00eb siguris\u00eb (Security Log)<\/h2>\n<p>\nKy \u00ebsht\u00eb vendi kryesor i ruajtjes s\u00eb regjistrave sistematik\u00eb t\u00eb siguris\u00eb. K\u00ebtu p\u00ebrfshihen ngjarjet e hyrjes\/daljes s\u00eb p\u00ebrdoruesve, aksesit n\u00eb objekte, ndryshimit t\u00eb politikave dhe aktiviteteve t\u00eb tjera t\u00eb lidhura me sigurin\u00eb. Natyrisht, n\u00ebse \u00ebsht\u00eb e konfigurueshme politika p\u00ebrkat\u00ebse.<\/p>\n<p><img decoding=\"async\" alt=\"\u00c7far\u00eb t\u00eb dobishme mund t\u00eb nxjerrim nga log-et e stacionit t\u00eb pun\u00ebs me OS Windows\" src=\"\/wp-content\/uploads\/2019\/04\/82e59ad17a09a8211dc6fe9737208fd7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Kontrolli i p\u00ebrdoruesve dhe grupeve (ngjarjet 4798 dhe 4799).<\/b> Malware, at the beginning of an attack, often sifts through local user accounts and local groups on a workstation to find credentials for its nefarious deeds. These events can help detect malicious code earlier than it might advance and, using the collected data, spread to other systems.<\/p>\n<p><b>Creation of a local account and changes to local groups (events 4720, 4722\u20134726, 4738, 4740, 4767, 4780, 4781, 4794, 5376, and 5377).<\/b> An attack can also start with the addition of a new user to the local administrators group.<\/p>\n<p><b>Login attempts with a local account (event 4624).<\/b> Regular users log in with a domain account, and detecting a login with a local account can indicate the beginning of an attack. Event 4624 also includes logins with a domain account, so when processing events, it is necessary to filter out events where the domain differs from the workstation's name.<\/p>\n<p><b>Attempt to log in with a specified account (event 4648).<\/b> Kjo ndodh kur procesi ekzekutohet n\u00eb modalitetin 'Ekzekuto si' (run as). N\u00eb m\u00ebnyr\u00eb normale, n\u00eb funksionimin sistemor kjo nuk duhet t\u00eb ndodh\u00eb, prandaj k\u00ebto ngjarje duhet t\u00eb jen\u00eb n\u00ebn kontroll.<\/p>\n<p><b>Bllokimi\/zhbllokimi i stacionit t\u00eb pun\u00ebs (ngjarjet 4800-4803).<\/b> Kategorit\u00eb e ngjarjeve t\u00eb dyshimta p\u00ebrfshijn\u00eb \u00e7do veprim q\u00eb ndodhi n\u00eb stacionin e pun\u00ebs t\u00eb bllokuar.<\/p>\n<p><b>Ndryshimet n\u00eb konfigurimin e firewall-it (ngjarjet 4944-4958).<\/b> \u00cbsht\u00eb e qart\u00eb se gjat\u00eb instalimit t\u00eb softuerit t\u00eb ri konfigurimi i firewall-it mund t\u00eb ndryshoj\u00eb, duke shkaktuar alarme false. Kontrollimi i k\u00ebtyre ndryshimeve n\u00eb shumic\u00ebn e rasteve nuk \u00ebsht\u00eb i nevojsh\u00ebm, por t\u00eb jesh n\u00eb dijeni t\u00eb tyre nuk do t\u00eb ishte e panevojshme.<\/p>\n<p><b>Lidhja e pajisjeve Plug\u2019n\u2019play (ngjarja 6416 dhe vet\u00ebm p\u00ebr Windows 10).<\/b> Kjo \u00ebsht\u00eb e r\u00ebnd\u00ebsishme p\u00ebr t\u00eb mbajtur n\u00ebn v\u00ebzhgim, n\u00ebse p\u00ebrdoruesit zakonisht nuk lidhin pajisje t\u00eb reja n\u00eb stacionin e pun\u00ebs, e papritur ata papritmas lidhin nj\u00eb t\u00eb till\u00eb.<\/p>\n<p>Windows p\u00ebrfshin 9 kategori auditimi dhe 50 subkategori p\u00ebr optimizim t\u00eb cili ndihmon p\u00ebr konfigurimin e holl\u00ebsish\u00ebm. Grupi minimal i subkategorive q\u00eb duhet aktivizuar n\u00eb konfigurime \u00ebsht\u00eb:<\/p>\n<p><b>Logon\/Logoff<\/b><\/p>\n<ul>\n<li>Logon;<\/li>\n<li>Logoff;<\/li>\n<li>Bllokimi i Llogaris\u00eb;<\/li>\n<li>Ngjarje t\u00eb tjera Logon\/Logoff.<\/li>\n<\/ul>\n<p>\n<b>Menaxhimi i Llogarive<\/b><\/p>\n<ul>\n<li>Menaxhimi i Llogarive t\u00eb P\u00ebrdoruesve;<\/li>\n<li>Menaxhimi i Grupeve t\u00eb Siguris\u00eb.<\/li>\n<\/ul>\n<p>\n<b>Ndryshimi i Politik\u00ebs<\/b><\/p>\n<ul>\n<li>Ndryshimi i Politik\u00ebs s\u00eb Auditimit;<\/li>\n<li>Ndryshimi i Politikes s\u00eb Autentifikimit;<\/li>\n<li>Ndryshimi i Politikes s\u00eb Autorizimit.<\/li>\n<\/ul>\n<p><\/p>\n<h2>Monitori i sistemit (Sysmon)<\/h2>\n<p>\nSysmon \u00ebsht\u00eb nj\u00eb mjet i integruar n\u00eb Windows q\u00eb regjistron ngjarjet n\u00eb regjistrin e sistemit. Zakonisht k\u00ebrkohet t\u00eb instalohet ve\u00e7mas.<\/p>\n<p><img decoding=\"async\" alt=\"\u00c7far\u00eb t\u00eb dobishme mund t\u00eb nxjerrim nga log-et e stacionit t\u00eb pun\u00ebs me OS Windows\" src=\"\/wp-content\/uploads\/2019\/04\/0b1e14fb9ba4d63a4d9d94bd9d62d112.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nK\u00ebto ngjarje mund t\u00eb gjenden gjithashtu n\u00eb regjistrin e siguris\u00eb (n\u00ebse aktivizohet politika e p\u00ebrkatshme e auditimit), por Sysmon ofron m\u00eb shum\u00eb detaje. Cilat ngjarje mund t\u00eb merren nga Sysmon?<\/p>\n<p><b>Krijimi i procesit (ID ngjarja 1).<\/b> Regjistri i ngjarjeve t\u00eb siguris\u00eb gjithashtu mund t\u00eb tregoj\u00eb kur \u00ebsht\u00eb nisur ndonj\u00eb *.exe dhe madje do t\u00eb tregoj\u00eb emrin dhe rrug\u00ebn e nisjes. Por ndryshe nga Sysmon, ai nuk mund t\u00eb tregoj\u00eb hash-in e aplikacionit. Softi i keq mund t\u00eb quhet madje edhe si notepad.exe, por hash-i do ta ekspozoj\u00eb at\u00eb.<\/p>\n<p><b>Koneksionet e rrjetit (ID ngjarja 3).<\/b> \u00cbsht\u00eb e qart\u00eb se ka shum\u00eb koneksione rrjetesh, dhe nuk \u00ebsht\u00eb e leht\u00eb t'i ndjek\u00ebsh t\u00eb gjitha. Por \u00ebsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb merret parasysh se Sysmon, ndryshe nga Regjistri i Siguris\u00eb, mund t\u00eb lidh\u00eb koneksionin e rrjetit me fushat ProcessID dhe ProcessGUID, duke treguar portin dhe <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sq\/lir\/ipv4\/\"   title=\"adresat IP\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"622\">adresat IP<\/a> burimin dhe marr\u00ebsin.<\/p>\n<p><b>Ndryshimet n\u00eb regjistrin sistemor (ID ngjarja 12-14).<\/b> M\u00ebnyra m\u00eb e thjesht\u00eb p\u00ebr t\u00eb shtuar veten n\u00eb start-up \u00ebsht\u00eb t\u00eb regjistrohesh n\u00eb regjistrin e sistemit. Security Log e b\u00ebn k\u00ebt\u00eb, por Sysmon tregon se kush b\u00ebri ndryshime, kur, nga ku, ID e procesit dhe vler\u00ebn e m\u00ebparshme t\u00eb \u00e7el\u00ebsit.<\/p>\n<p><b>Krijimi i nj\u00eb skedari (ID e ngjarjes 11).<\/b> Sysmon, n\u00eb ndryshim nga Security Log, do t\u00eb tregoj\u00eb jo vet\u00ebm vendndodhjen e skedarit, por edhe emrin e tij. E qart\u00eb \u00ebsht\u00eb se nuk mund t\u00eb ndiqni gjith\u00e7ka, por mund t\u00eb b\u00ebni audite t\u00eb drejtorive t\u00eb caktuara.<\/p>\n<p>Dhe tani ajo q\u00eb nuk \u00ebsht\u00eb n\u00eb politik\u00ebn e Security Log, por \u00ebsht\u00eb n\u00eb Sysmon:<\/p>\n<p><b>Ndryshimi i dat\u00ebs s\u00eb krijimit t\u00eb skedarit (ID e ngjarjes 2).<\/b> Disa malware mund t\u00eb z\u00ebvend\u00ebsojn\u00eb dat\u00ebn e krijimit t\u00eb skedarit p\u00ebr ta fshehur at\u00eb nga raportet me skedar\u00ebt e sapo krijuar.<\/p>\n<p><b>Ngarkimi i drejtuesve dhe biblioteka dinamike (ID e ngjarjeve 6-7).<\/b> Ndjekja e ngarkimit t\u00eb DLL dhe drejtuesve t\u00eb pajisjeve n\u00eb memorje, kontrollimi i n\u00ebnshkrimit digjital dhe vlefshm\u00ebria e tij.<\/p>\n<p><b>Krijimi i nj\u00eb rrjedhe n\u00eb nj\u00eb proces t\u00eb ekzekutuar (ID e ngjarjes 8).<\/b> Nj\u00eb nga llojet e sulmeve q\u00eb gjithashtu duhet t\u00eb ndiqet.<\/p>\n<p><b>Ngjarjet RawAccessRead (ID e ngjarjes 9).<\/b> Operacione t\u00eb leximit nga disku me ndihm\u00ebn e \u201c.\u201d. N\u00eb shumic\u00ebn d\u00ebrrmuese t\u00eb rasteve, nj\u00eb aktivitet i till\u00eb duhet t\u00eb konsiderohet anormal.<\/p>\n<p><b>Krijimi i nj\u00eb rrjedhe t\u00eb em\u00ebruar t\u00eb skedarit (ID e ngjarjes 15).<\/b> Nj\u00eb ngjarje regjistrohet kur krijohet nj\u00eb rrjedh\u00eb file me em\u00ebr, e cila gjeneron ngjarje me hash t\u00eb p\u00ebrmbajtjes s\u00eb skedarit.<\/p>\n<p><b>Krijimi i nj\u00eb rrjedhe file me em\u00ebr dhe lidhja (ID e ngjarjes 17-18).<\/b> Ndjekja e kodit t\u00eb d\u00ebmsh\u00ebm q\u00eb komunikon me komponent\u00ebt e tjer\u00eb p\u00ebrmes nj\u00eb rrjedhe file me em\u00ebr.<\/p>\n<p><b>Aktiviteti nga WMI (ID e ngjarjes 19).<\/b> Regjistrimi i ngjarjeve q\u00eb gjenerohen kur qasje b\u00ebhet n\u00eb sistem p\u00ebrmes protokollit WMI.<\/p>\n<p>P\u00ebr t\u00eb mbrojtur vet\u00eb Sysmon, duhet t\u00eb ndiqen ngjarjet me ID 4 (ndalimi dhe nisja e Sysmon) dhe ID 16 (ndryshimi i konfigurimit t\u00eb Sysmon).<\/p>\n<h2>Dienet e Power Shell.<\/h2>\n<p>\nPower Shell \u00ebsht\u00eb nj\u00eb mjet i fuqish\u00ebm p\u00ebr menaxhimin e infrastruktur\u00ebs Windows, k\u00ebshtu q\u00eb ka shum\u00eb mund\u00ebsi q\u00eb nj\u00eb sulmues ta zgjedh\u00eb at\u00eb. T\u00eb dh\u00ebnat mbi ngjarjet Power Shell mund t\u00eb merren nga dy burime: regjistri i Windows PowerShell dhe regjistri Microsoft-WindowsPowerShell \/ Operational.<\/p>\n<h4>Regjistri i Windows PowerShell.<\/h4>\n<p>\n<img decoding=\"async\" alt=\"\u00c7far\u00eb t\u00eb dobishme mund t\u00eb nxjerrim nga log-et e stacionit t\u00eb pun\u00ebs me OS Windows\" src=\"\/wp-content\/uploads\/2019\/04\/03d830871fc2c47ceeb8f0822f3f20e0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>\u00cbsht\u00eb ngarkuar nj\u00eb ofrues t\u00eb dh\u00ebnash (ID e ngjarjes 600).<\/b> Furnizuesit e PowerShell jan\u00eb programe q\u00eb sh\u00ebrbejn\u00eb si burim t\u00eb dh\u00ebnash p\u00ebr PowerShell p\u00ebr t'i par\u00eb dhe p\u00ebr t'i menaxhuar ato. P\u00ebr shembull, furnizuesit e integruar mund t\u00eb jen\u00eb variablat e ambientit t\u00eb Windows-it ose regjistri i sistemit. Duhet t\u00eb ndiqni shfaqjen e furnizuesve t\u00eb rinj p\u00ebr t\u00eb identifikuar n\u00eb koh\u00eb aktivitete t\u00eb d\u00ebmshme. P\u00ebr shembull, n\u00ebse v\u00ebreni se mes furnizuesve \u00ebsht\u00eb shfaqur WSMan, kjo do t\u00eb thot\u00eb se \u00ebsht\u00eb nisur nj\u00eb seanc\u00eb e larg\u00ebt PowerShell.<\/p>\n<h4>Microsoft-WindowsPowerShell \/ Log operativ (ose MicrosoftWindows-PowerShellCore \/ Log operativ n\u00eb PowerShell 6)<\/h4>\n<p>\n<img decoding=\"async\" alt=\"\u00c7far\u00eb t\u00eb dobishme mund t\u00eb nxjerrim nga log-et e stacionit t\u00eb pun\u00ebs me OS Windows\" src=\"\/wp-content\/uploads\/2019\/04\/d0a1a74aad59c7c4f64446b52846429f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Regjistrimi i moduleve (ID ngjarjes 4103).<\/b> N\u00eb ngjarje ruhet informacioni mbi \u00e7do komand\u00eb t\u00eb ekzekutuar dhe parametrat me t\u00eb cil\u00ebt ajo \u00ebsht\u00eb thirrur.<\/p>\n<p><b>Regjistrimi i bllokimit t\u00eb skriptive (ID ngjarjes 4104).<\/b> Gazetimi i bllokimit t\u00eb skripteve tregon \u00e7do bllok kodin PowerShell q\u00eb ekzekutohet. Edhe n\u00ebse nj\u00eb sulmues p\u00ebrpiqet t\u00eb fsheh\u00eb komand\u00ebn, ky lloj ngjarjeje do t\u00eb tregoj\u00eb komand\u00ebn PowerShell q\u00eb \u00ebsht\u00eb realizuar n\u00eb t\u00eb v\u00ebrtet\u00eb. Gjithashtu, n\u00eb k\u00ebt\u00eb lloj ngjarjeje mund t\u00eb regjistrohen disa thirrje API t\u00eb nivelit t\u00eb ul\u00ebt q\u00eb ekzekutohen, k\u00ebto ngjarje zakonisht regjistrohen si Verbose, por n\u00ebse p\u00ebrdoret nj\u00eb komand\u00eb ose skenar i dyshimt\u00eb n\u00eb bllokun e kodit, do t\u00eb regjistrohet si me r\u00ebnd\u00ebsi Warning.<\/p>\n<p>Kini parasysh se pas konfigurimit t\u00eb mjetit p\u00ebr mbledhjen dhe analiz\u00ebn e k\u00ebtyre ngjarjeve, do t\u00eb nevojitet koh\u00eb shtes\u00eb p\u00ebr rregullimin p\u00ebr t\u00eb reduktuar numrin e alarmeve false.<\/p>\n<p>Na tregoni n\u00eb komentet se \u00e7far\u00eb log-esh mbledhni p\u00ebr auditimin e siguris\u00eb informative dhe cilat mjete p\u00ebrdorni p\u00ebr k\u00ebt\u00eb. Nj\u00eb nga drejtimet tona \u00ebsht\u00eb zgjidhjet p\u00ebr auditimin e ngjarjeve t\u00eb siguris\u00eb informative. P\u00ebr t\u00eb zgjidhur detyr\u00ebn e mbledhjes dhe analiz\u00ebs s\u00eb log-\u00ebve, mund t\u00eb sugjerojm\u00eb t\u00eb shikoni <noindex><a rel=\"nofollow\" href=\"https:\/\/www.quest.com\/products\/intrust\/\">Quest InTrust<\/a><\/noindex>, i cili mund t\u00eb kompresoj\u00eb t\u00eb dh\u00ebnat e ruajtura me nj\u00eb raport 20:1, dhe nj\u00eb kopje e instaluar e tij \u00ebsht\u00eb n\u00eb gjendje t\u00eb p\u00ebrpunoj\u00eb deri n\u00eb 60000 ngjarje n\u00eb sekond\u00eb nga 10000 burime.<br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/447522\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0439\u0442\u0438 \u043d\u0430 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u043f\u043e\u0447\u0442\u0443 \u043f\u0438\u0441\u044c\u043c\u043e \u0432\u0440\u043e\u0434\u0435 \u0431\u044b \u0438\u0437 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430, \u043d\u043e \u0441\u043e \u0441\u0441\u044b\u043b\u043a\u043e\u0439 \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0439 \u0441\u0430\u0439\u0442. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u043a\u0442\u043e-\u0442\u043e \u0441\u043a\u0430\u0447\u0430\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0443\u0442\u0438\u043b\u0438\u0442\u0443 \u0438\u0437 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u043a\u0430\u043a\u043e\u0433\u043e \u043c\u0435\u0441\u0442\u0430. \u0414\u0430 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u0438\u0434\u0443\u043c\u0430\u0442\u044c \u043d\u0435 \u043e\u0434\u0438\u043d \u0434\u0435\u0441\u044f\u0442\u043e\u043a \u043a\u0435\u0439\u0441\u043e\u0432, \u043a\u0430\u043a \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043c\u043e\u0436\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c\u0441\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23255,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31289","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0439\u0442\u0438 \u043d\u0430 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u043f\u043e\u0447\u0442\u0443 \u043f\u0438\u0441\u044c\u043c\u043e \u0432\u0440\u043e\u0434\u0435 \u0431\u044b \u0438\u0437 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430, \u043d\u043e \u0441\u043e \u0441\u0441\u044b\u043b\u043a\u043e\u0439 \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0439 \u0441\u0430\u0439\u0442. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u043a\u0442\u043e-\u0442\u043e \u0441\u043a\u0430\u0447\u0430\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0443\u0442\u0438\u043b\u0438\u0442\u0443 \u0438\u0437 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u043a\u0430\u043a\u043e\u0433\u043e \u043c\u0435\u0441\u0442\u0430. \u0414\u0430 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u0438\u0434\u0443\u043c\u0430\u0442\u044c \u043d\u0435 \u043e\u0434\u0438\u043d \u0434\u0435\u0441\u044f\u0442\u043e\u043a \u043a\u0435\u0439\u0441\u043e\u0432, \u043a\u0430\u043a \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043c\u043e\u0436\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c\u0441\u044f\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0427\u0442\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0432\u044b\u0442\u0430\u0449\u0438\u0442\u044c \u0438\u0437 \u043b\u043e\u0433\u043e\u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0441\u0442\u0430\u043d\u0446\u0438\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 \u041e\u0421 Windows | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0439\u0442\u0438 \u043d\u0430 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u043f\u043e\u0447\u0442\u0443 \u043f\u0438\u0441\u044c\u043c\u043e \u0432\u0440\u043e\u0434\u0435 \u0431\u044b \u0438\u0437 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430, \u043d\u043e \u0441\u043e \u0441\u0441\u044b\u043b\u043a\u043e\u0439 \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0439 \u0441\u0430\u0439\u0442. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u043a\u0442\u043e-\u0442\u043e \u0441\u043a\u0430\u0447\u0430\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0443\u0442\u0438\u043b\u0438\u0442\u0443 \u0438\u0437 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u043a\u0430\u043a\u043e\u0433\u043e \u043c\u0435\u0441\u0442\u0430. \u0414\u0430 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u0438\u0434\u0443\u043c\u0430\u0442\u044c \u043d\u0435 \u043e\u0434\u0438\u043d \u0434\u0435\u0441\u044f\u0442\u043e\u043a \u043a\u0435\u0439\u0441\u043e\u0432, \u043a\u0430\u043a \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043c\u043e\u0436\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c\u0441\u044f\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:40:29+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:40:29+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00c7far\u00eb \u00ebsht\u00eb e dobishme p\u00ebr t\u00eb nxjerr\u00eb nga log-et e stacionit t\u00eb pun\u00ebs bazuar n\u00eb sistemin operativ Windows | ProHoster","description":"Stacioni i pun\u00ebs p\u00ebr p\u00ebrdoruesit \u2014 vendi m\u00eb i ndjesh\u00ebm n\u00eb infrastruktur\u00eb p\u00ebr sa i p\u00ebrket siguris\u00eb informative. P\u00ebrdoruesve mund t'u vij\u00eb n\u00eb emailin e pun\u00ebs nj\u00eb let\u00ebr q\u00eb duket se \u00ebsht\u00eb nga nj\u00eb burim i sigurt, por me nj\u00eb lidhje n\u00eb nj\u00eb faqe t\u00eb infektuar. Mund t\u00eb ndodh\u00eb q\u00eb dikush t\u00eb shkarkoj\u00eb nj\u00eb mjete t\u00eb dobishme p\u00ebr pun\u00eb nga nj\u00eb vend t\u00eb panjohur. Mund t\u00eb mendojm\u00eb p\u00ebr nj\u00ebzetra raste se si p\u00ebrmes p\u00ebrdoruesve malware mund t\u00eb dep\u00ebrtoj\u00eb.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0442\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0432\u044b\u0442\u0430\u0449\u0438\u0442\u044c \u0438\u0437 \u043b\u043e\u0433\u043e\u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0441\u0442\u0430\u043d\u0446\u0438\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 \u041e\u0421 Windows | ProHoster","og:description":"\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0439\u0442\u0438 \u043d\u0430 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u043f\u043e\u0447\u0442\u0443 \u043f\u0438\u0441\u044c\u043c\u043e \u0432\u0440\u043e\u0434\u0435 \u0431\u044b \u0438\u0437 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430, \u043d\u043e \u0441\u043e \u0441\u0441\u044b\u043b\u043a\u043e\u0439 \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0439 \u0441\u0430\u0439\u0442. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u043a\u0442\u043e-\u0442\u043e \u0441\u043a\u0430\u0447\u0430\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0443\u0442\u0438\u043b\u0438\u0442\u0443 \u0438\u0437 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u043a\u0430\u043a\u043e\u0433\u043e \u043c\u0435\u0441\u0442\u0430. \u0414\u0430 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u0438\u0434\u0443\u043c\u0430\u0442\u044c \u043d\u0435 \u043e\u0434\u0438\u043d \u0434\u0435\u0441\u044f\u0442\u043e\u043a \u043a\u0435\u0439\u0441\u043e\u0432, \u043a\u0430\u043a \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043c\u043e\u0436\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c\u0441\u044f","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:40:29+00:00","article:modified_time":"2019-10-31T18:40:29+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31289","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:25:31","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:19:49","updated":"2026-02-08 20:25:31","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/31289","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=31289"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/31289\/revisions"}],"predecessor-version":[{"id":157813,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/31289\/revisions\/157813"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/23255"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=31289"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=31289"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=31289"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}