Collecting Windows telemetry with Elastic: An introduction to the ETW Filebeat input

From this output, we can see that the provider Microsoft-Windows-DNSServer offers several keywords for filtering specific event types, such as QUERY_RECEIVED, RESPONSE_SUCCESS, RESPONSE_FAILURE, and others — each represented by a unique hex code. Additionally, it provides levels (Error, Warning, Informational) that specify the severity of events that can be captured.

The Filebeat ETW input offers filtering options that allow you to capture only relevant events from a specific provider:

• match_any_keyword: Captures events if they match any one of the specified keywords. This is useful when you want to monitor a range of event types that don’t necessarily occur together.

• match_all_keyword: Captures events only if they match all specified keywords. This option is ideal for highly specific event monitoring where events must meet multiple criteria simultaneously.

• trace_level: Filters events based on their severity level, allowing you to specify whether to capture only errors, warnings, or informational messages. This can help to focus monitoring efforts on high-priority issues.

The output from logman lists various event types with corresponding keywords, allowing you to select specific events to monitor. For example, if you want to track recursive queries, you might look for keywords like RECURSE_QUERY_OUT, RECURSE_RESPONSE_IN, or RECURSE_QUERY_DROP. To filter specifically for these recursive query events, you would calculate the bitmask sum of their values:

1. Identify the hex values for each keyword:

• RECURSE_QUERY_OUT: 0x0000000000000010

• RECURSE_RESPONSE_IN: 0x0000000000000020

• RECURSE_QUERY_DROP: 0x0000000000000040

• Microsoft-Windows-DNSServer/Analytical (to ensure Analytical events are captured): 0x8000000000000000

2. Add these values together:

This resulting bitmask, 0x8000000000000070, would be used in the match_any_keyword configuration to capture only these specific recursive query events.

This approach allows for granular control over the data the ETW input ingests, ensuring you collect only events that are relevant to your monitoring needs.