Configuration Examples

---

Vanilla TFPlenum Config

The baseline configuration deployed by TFPlenum on a DIP built IAW 262COS-DIP-SOP-001. Collects the core Windows channels with Security and Sysmon enrichment processors, and includes ForwardedEvents support for WEF environments.

winlogbeat.event_logs:
  - name: Application
    ignore_older: 72h

  - name: System

  - name: Security
    processors:
      - script:
          lang: javascript
          id: security
          file: ${path.home}/module/security/config/winlogbeat-security.js

  - name: Microsoft-Windows-Sysmon/Operational
    processors:
      - script:
          lang: javascript
          id: sysmon
          file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js

  - name: ForwardedEvents
    tags: [forwarded]
    processors:
      - script:
          when.equals.winlog.channel: Security
          lang: javascript
          id: security
          file: ${path.home}/module/security/config/winlogbeat-security.js
      - script:
          when.equals.winlog.channel: Microsoft-Windows-Sysmon/Operational
          lang: javascript
          id: sysmon
          file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js

setup.template.settings:
  index.number_of_shards: 2

output.logstash:
  hosts: ["<DIP_EXTERNAL_IP>:5045"]
  ssl.certificate_authorities: ["${path.home}/ca.crt"]
  ssl.certificate: "${path.home}/tls.crt"
  ssl.key: "${path.home}/tls.key"

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~

logging.to_files: true
logging.files:
  path: C:\ProgramData\winlogbeat\Logs
logging.level: info

---

262COS Custom Config

The 262COS/DOK tuned configuration. Expands channel coverage to include PowerShell, WinRM, WMI, Task Scheduler, BITS, Windows Defender, and RDP channels. Applies ignore_older: 168h across all channels and excludes known-noise event IDs. Removes SSL cert file pinning to survive DIP rebuilds.

winlogbeat.event_logs:

  - name: Application
    ignore_older: 168h

  - name: System
    ignore_older: 168h

  - name: Security
    ignore_older: 168h
    event_id: -4703           # Exclude: token right adjustment (high-volume, low value)

  - name: Microsoft-Windows-Sysmon/Operational
    ignore_older: 168h

  - name: Microsoft-Windows-Bits-Client/Operational
    ignore_older: 168h
    event_id: 3,4,59,60       # Include only: job created, modified, completed, error

  - name: "Microsoft-Windows-Windows Defender/Operational"
    ignore_older: 168h

  - name: Microsoft-Windows-WinRM/Operational
    ignore_older: 168h
    event_id: -254,-145,-132,-10   # Exclude: verbose internal trace/poll events

  - name: Microsoft-Windows-PowerShell/Operational
    ignore_older: 168h
    event_id: -8193,-8194,-8195,-8196,-8197,-12039   # Exclude: cmdlet/pipeline noise

  - name: Microsoft-Windows-TaskScheduler/Operational
    ignore_older: 168h

  - name: Microsoft-Windows-WMI-Activity/Operational
    ignore_older: 168h
    event_id: -5857,-5858     # Exclude: provider start and benign query errors

  - name: Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
    ignore_older: 168h

  - name: Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
    ignore_older: 168h

  - name: Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
    ignore_older: 168h

  - name: "Windows PowerShell"
    ignore_older: 168h

  - name: ForwardedEvents
    ignore_older: 168h
    tags: [forwarded]

output.logstash:
  hosts: ["<DIP_EXTERNAL_IP>:5045"]
  ssl.enabled: true
  ssl.verification_mode: "none"

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~

---

Differences Between Configs

Setting	Vanilla TFPlenum	262COS Custom
ignore_older	72h (Application only)	168h (all channels)
Channels	Application, System, Security, Sysmon, ForwardedEvents	All vanilla + PowerShell, Legacy PS, WinRM, TaskScheduler, WMI, BITS, Defender, 3x RDP
Event ID filtering	None	Security (-4703), PowerShell (-6 IDs), WinRM (-4 IDs), WMI (-2 IDs), BITS (include 4 IDs only)
SSL	Certificate files pinned	ssl.verification_mode: "none" (survives DIP rebuilds)
Enrichment processors	Security + Sysmon scripts	Not included (add back if using a DIP with the JS modules present)

Add Enrichment Processors to the 262COS Config

The 262COS config above omits the JavaScript enrichment processors for clarity. If the DIP has the Winlogbeat modules present (standard on TFPlenum DIPs), add the processors blocks back under the Security and Sysmon channels for ECS field normalization.

---