Locked Workstation

Automatically lock workstation sessions after a standard period of inactivity. The case is not applicable for Unix OS. Supported OS - Windows 2008 R2 and 7, Windows 2012 R2 and 8.1, Windows 2016 and 10 Windows Server 2019.

Rule Content

- title: Locked Workstation
  id: 411742ad-89b0-49cb-a7b0-3971b5c1e0a4
  description: Automatically lock workstation sessions after a standard period of
    inactivity. The case is not applicable for Unix OS. Supported OS - Windows 2008
    R2 and 7, Windows 2012 R2 and 8.1, Windows 2016 and 10 Windows Server 2019.
  author: Alexandr Yampolskyi, SOC Prime
  status: stable
  references:
  - https://www.cisecurity.org/controls/cis-controls-list/
  - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
  - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4800
  date: 2019/03/26
  logsource:
    product: windows
    service: security
    category: null
  detection:
    selection:
      EventID:
      - 4800
    condition: selection
  falsepositives:
  - unknown
  level: low
  tags:
  - CSC16
  - CSC16.11
  - ISO27002-2013 A.9.1.1
  - ISO27002-2013 A.9.2.1
  - ISO27002-2013 A.9.2.2
  - ISO27002-2013 A.9.2.3
  - ISO27002-2013 A.9.2.4
  - ISO27002-2013 A.9.2.5
  - ISO27002-2013 A.9.2.6
  - ISO27002-2013 A.9.3.1
  - ISO27002-2013 A.9.4.1
  - ISO27002-2013 A.9.4.3
  - ISO27002-2013 A.11.2.8
  - PCI DSS 3.1 7.1
  - PCI DSS 3.1 7.2
  - PCI DSS 3.1 7.3
  - PCI DSS 3.1 8.7
  - PCI DSS 3.1 8.8
  - NIST CSF 1.1 PR.AC-1
  - NIST CSF 1.1 PR.AC-4
  - NIST CSF 1.1 PR.AC-6
  - NIST CSF 1.1 PR.AC-7
  - NIST CSF 1.1 PR.PT-3

Querying Elasticsearch

Import Libraries



In [ ]:

    
from elasticsearch import Elasticsearch
from elasticsearch_dsl import Search
import pandas as pd

Initialize Elasticsearch client



In [ ]:

    
es = Elasticsearch(['http://helk-elasticsearch:9200'])
searchContext = Search(using=es, index='logs-endpoint-winevent-security-*', doc_type='doc')

Run Elasticsearch Query



In [ ]:

    
s = searchContext.query('query_string', query='event_id:("4800")')
response = s.execute()
if response.success():
    df = pd.DataFrame((d.to_dict() for d in s.scan()))

Show Results



In [ ]:

    
df.head()