The Problem
Investigating malicious Windows logons is a pain in the neck. If you’ve ever tried sifting through Windows event logs, you know it’s like finding a needle in a haystack—assuming the needle is a sign of a security breach and the haystack is full of irrelevant data. LogonTracer tackles this mess by visualizing logon attempts, making it easier to spot the bad actors.
What This Does
LogonTracer visualizes Windows Active Directory event logs, coupling hostnames or IPs with account names. It processes event IDs like 4624 for successful logons and 4625 for failures, among others, to create a graph that shows where and when logon attempts occur. Check out the config/config.yml for configuration details and the README.md for installation instructions.
The project structure is pretty straightforward. You’ve got multiple docker-compose setups in the docker-compose-with-elasticstack and docker-compose-with-nginx folders, each with their respective Dockerfiles. If you’re familiar with Docker, you can spin this up quickly. Just run docker-compose up and you're in business.
Real-World Use
Imagine you’re the security lead at a mid-sized company, and you’ve noticed some odd logon patterns. You fire up LogonTracer and point it at your event logs. Within minutes, you see a graph that links a specific account attempting logons from various machines, revealing a potential breach. You could even use the docker-compose/docker-compose.yml to set up a local instance and visualize this data without much hassle.
docker-compose -f docker-compose/docker-compose.yml up
The Bottom Line
LogonTracer is a solid tool for anyone needing to analyze Windows logon activity. It’s especially useful for security teams hunting for anomalies in logon behavior, but if you’re just looking for a lightweight solution, this might feel like overkill. The reliance on Docker and Neo4j can also add complexity, so be prepared for that. Overall, it’s a handy tool if you know what you’re doing.