{"id":37,"title":"Windows'da SIEM Entegrasyonu","content":"<h3><strong>1. SIEM Nedir ve Neden &Ouml;nemlidir?<\/strong><\/h3>\n<p>SIEM (Security Information and Event Management), g&uuml;venlik olaylar\u0131n\u0131 merkezi olarak toplar, analiz eder ve raporlar. Windows sunuculardan SIEM&rsquo;e log g&ouml;nderimi, g&uuml;venlik takibi ve tehdit tespitinde kritik rol oynar. (<a title=\"SIEM ve SOC Farklar\u0131 Nelerdir?\" href=\"https:\/\/bulutistan.com\/blog\/siem-ve-soc-farklari-nelerdir\/?utm_source=chatgpt.com\">Bulutistan<\/a>)<\/p>\n<hr>\n<h2><strong>2. Gereken Eri\u015fimler<\/strong><\/h2>\n<p>Windows ortam\u0131ndan SIEM&rsquo;e veri toplanabilmesi i&ccedil;in a\u015fa\u011f\u0131daki kaynaklara eri\u015filmelidir:<\/p>\n<ul>\n<li>\n<p><strong>Event Log&rsquo;lar:<\/strong> G&uuml;venlik, Sistem ve Uygulama kay\u0131tlar\u0131. (<a title=\"SIEM Log Collection Explained: Sources, Methods, and ...\" href=\"https:\/\/searchinform.com\/articles\/cybersecurity\/measures\/siem\/analytics\/log-management\/log-collection\/?utm_source=chatgpt.com\">searchinform.com<\/a>)<\/p>\n<\/li>\n<li>\n<p><strong>WMI (Windows Management Instrumentation):<\/strong> Sistem verileri ve performans &ouml;l&ccedil;&uuml;mleri. (<a title=\"SIEM - - &Ouml;nder Ak&ouml;z\" href=\"..\/..\/..\/siem?utm_source=chatgpt.com\">&Ouml;nder Online<\/a>)<\/p>\n<\/li>\n<li>\n<p><strong>WinRM (Remote Management):<\/strong> Uzak y&ouml;netim ve komut y&uuml;r&uuml;tme. (<a title=\"SIEM - - &Ouml;nder Ak&ouml;z\" href=\"..\/..\/..\/siem?utm_source=chatgpt.com\">&Ouml;nder Online<\/a>)<\/p>\n<\/li>\n<li>\n<p><strong>DCOM:<\/strong> Da\u011f\u0131t\u0131k uygulama eri\u015fimleri i&ccedil;in gerekli sistem komponenti. (<a title=\"SIEM - - &Ouml;nder Ak&ouml;z\" href=\"..\/..\/..\/siem?utm_source=chatgpt.com\">&Ouml;nder Online<\/a>)<\/p>\n<\/li>\n<\/ul>\n<p>Bu eri\u015fimlerin her biri i&ccedil;in uygun izinler ve servisler etkin olmal\u0131d\u0131r.<\/p>\n<hr>\n<h2><strong>3. Ad\u0131m Ad\u0131m Yap\u0131land\u0131rma<\/strong><\/h2>\n<h3><strong>3.1. Kullan\u0131c\u0131 Yetkileri<\/strong><\/h3>\n<p>SIEM i&ccedil;in &ouml;zel bir hesap (&ouml;rne\u011fin <code>siem_user<\/code>) olu\u015ftur ve a\u015fa\u011f\u0131daki gruplara ekle:<\/p>\n<pre><code class=\"language-powershell\">$Groups = @(\"Performance Monitor Users\", \"Event Log Readers\", \"Distributed COM Users\")\n\nforeach ($Group in $Groups) {\n    Add-LocalGroupMember -Group $Group -Member \"siem_user\"\n    Write-Host \"$Group grubuna eklendi\"\n}\n<\/code><\/pre>\n<ul>\n<li>\n<p><em>Performance Monitor Users:<\/em> Performans verilerini okumaya izin verir.<\/p>\n<\/li>\n<li>\n<p><em>Event Log Readers:<\/em> Olay g&uuml;nl&uuml;klerini okuma yetene\u011fi sa\u011flar.<\/p>\n<\/li>\n<li>\n<p><em>Distributed COM Users:<\/em> DCOM ve WMI eri\u015fimleri i&ccedil;in gereklidir.<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h3><strong>3.2. WMI \u0130zinleri<\/strong><\/h3>\n<p>WMI verilerine eri\u015fim, SIEM sistemlerinin sistem bilgilerini ve servis durumlar\u0131n\u0131 alabilmesi i&ccedil;in gereklidir.<br>Bunu manuel olarak <code>wmimgmt.msc<\/code> arac\u0131ndan yap\u0131land\u0131rabilirsin:<\/p>\n<ol>\n<li>\n<p>&Ccedil;al\u0131\u015ft\u0131r (<code>Win + R<\/code>) &rarr; <code>wmimgmt.msc<\/code><\/p>\n<\/li>\n<li>\n<p>WMI Control &rarr; Properties &rarr; Security&rsquo;e git.<\/p>\n<\/li>\n<li>\n<p>A\u015fa\u011f\u0131daki namespace&rsquo;lere <code>Remote Enable<\/code> gibi gerekli izinleri ver:<\/p>\n<ul>\n<li>\n<p><code>root\\cimv2<\/code><\/p>\n<\/li>\n<li>\n<p><code>root\\default<\/code><\/p>\n<\/li>\n<li>\n<p><code>root\\wmi<\/code><\/p>\n<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<hr>\n<h3><strong>3.3. Event Log Eri\u015fimi<\/strong><\/h3>\n<p>Event log&rsquo;lar\u0131n\u0131 okumak i&ccedil;in kullan\u0131c\u0131ya ilgili log anahtarlar\u0131n\u0131n registry izinleri verilmelidir:<\/p>\n<pre><code class=\"language-powershell\">$EventLogs = @(\"Application\", \"System\", \"Security\")\n\nforeach ($LogName in $EventLogs) {\n    $RegPath = \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\EventLog\\$LogName\"\n    $Acl = Get-Acl $RegPath\n    $AccessRule = New-Object System.Security.AccessControl.RegistryAccessRule(\n        \"COMPUTERNAME\\siem_user\",\n        \"ReadKey\",\n        \"ContainerInherit,ObjectInherit\",\n        \"None\",\n        \"Allow\"\n    )\n    $Acl.SetAccessRule($AccessRule)\n    Set-Acl -Path $RegPath -AclObject $Acl\n}\n<\/code><\/pre>\n<hr>\n<h3><strong>3.4. WinRM (Remote Management)<\/strong><\/h3>\n<p>WinRM&rsquo;i etkinle\u015ftir ve temel yap\u0131land\u0131rmay\u0131 yap:<\/p>\n<pre><code class=\"language-powershell\">winrm quickconfig -quiet\n\nwinrm set winrm\/config\/service '@{AllowUnencrypted=\"true\"}'\nwinrm set winrm\/config\/service\/auth '@{Basic=\"true\"}'\n\nGet-Service WinRM | Start-Service\n<\/code><\/pre>\n<p>Bu, uzaktan y&ouml;netim i&ccedil;in WinRM servisini aktif eder.<\/p>\n<hr>\n<h2><strong>4. Test ve Do\u011frulama<\/strong><\/h2>\n<p>Yap\u0131land\u0131rmadan sonra eri\u015fimin ba\u015far\u0131l\u0131 oldu\u011funu test etmek &ouml;nemlidir:<\/p>\n<p><strong>Grup &uuml;yelik testi:<\/strong><\/p>\n<pre><code class=\"language-powershell\">Get-LocalGroupMember -Group \"Event Log Readers\"\n<\/code><\/pre>\n<p><strong>Event Log eri\u015fimi:<\/strong><\/p>\n<pre><code class=\"language-powershell\">Get-WinEvent -LogName System -MaxEvents 5\n<\/code><\/pre>\n<p><strong>WMI testi:<\/strong><\/p>\n<pre><code class=\"language-powershell\">Get-WmiObject -Class Win32_ComputerSystem\n<\/code><\/pre>\n<p><strong>WinRM ba\u011flant\u0131 testi:<\/strong><\/p>\n<pre><code class=\"language-powershell\">Test-NetConnection -ComputerName localhost -Port 5985\n<\/code><\/pre>\n<hr>\n<h2><strong>5. Basit Bir &ldquo;Health Check&rdquo; Script&rsquo;i<\/strong><\/h2>\n<p>T&uuml;m temel kontrolleri tek seferde yapan basit bir test script&rsquo;i:<\/p>\n<pre><code class=\"language-powershell\">$UserName = \"siem_user\"\n\n# Grup Kontrolleri\n$Groups = @(\"Performance Monitor Users\", \"Event Log Readers\", \"Distributed COM Users\")\nforeach ($Group in $Groups) {\n    Write-Host $Group\n    Get-LocalGroupMember -Group $Group\n}\n\n# Event Log Test\nGet-WinEvent -LogName System -MaxEvents 1\n\n# WinRM Servis Durumu\nGet-Service WinRM\n<\/code><\/pre>\n<p>Bu script ile h\u0131zl\u0131 bir &ouml;n kontrol yapabilirsin.<\/p>\n<hr>\n<h2><strong>6. G&uuml;venlik Tavsiyeleri<\/strong><\/h2>\n<ul>\n<li>\n<p>Minimum izin prensibini uygula: Sadece gerekli haklar\u0131 ver.<\/p>\n<\/li>\n<li>\n<p>g&uuml;&ccedil;l&uuml; parolalar ve hesap politikalar\u0131 kullan.<\/p>\n<\/li>\n<li>\n<p>SIEM kullan\u0131c\u0131 hesap aktivitelerini ayr\u0131 olarak izle.<\/p>\n<\/li>\n<li>\n<p>WinRM ba\u011flant\u0131lar\u0131n\u0131 g&uuml;venli protokoller &uuml;zerinden (HTTPS) s\u0131n\u0131rla.<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2><strong>K\u0131sa Notlar<\/strong><\/h2>\n<ul>\n<li>\n<p>SIEM, geni\u015f log kaynaklar\u0131n\u0131 analiz eden merkezi bir g&uuml;venlik arac\u0131d\u0131r. (<a title=\"SIEM Integration best practices | ADAudit|Plus\" href=\"https:\/\/www.manageengine.com\/products\/active-directory-audit\/kb\/best-practices\/siem-integration-best-practices.html?utm_source=chatgpt.com\">manageengine.com<\/a>)<\/p>\n<\/li>\n<li>\n<p>Windows Event Log&rsquo;lar SIEM i&ccedil;in zengin g&uuml;venlik bilgileri sa\u011flar. (<a title=\"SIEM Log Collection Explained: Sources, Methods, and ...\" href=\"https:\/\/searchinform.com\/articles\/cybersecurity\/measures\/siem\/analytics\/log-management\/log-collection\/?utm_source=chatgpt.com\">searchinform.com<\/a>)<\/p>\n<\/li>\n<li>\n<p>WMI ve WinRM, uzaktan veri toplama i&ccedil;in kritik servislerdir. (<a title=\"SIEM - - &Ouml;nder Ak&ouml;z\" href=\"..\/..\/..\/siem?utm_source=chatgpt.com\">&Ouml;nder Online<\/a>)<\/p>\n<\/li>\n<\/ul>\n<hr>\n<p>A\u015fa\u011f\u0131da, daha &ouml;nce bahsetti\u011fimiz t&uuml;m <strong>Windows SIEM entegrasyonu<\/strong> ad\u0131mlar\u0131n\u0131 <strong>tek paket<\/strong>, <strong>mod&uuml;ler<\/strong>, <strong>okunabilir<\/strong>, <strong>bak\u0131m\u0131 kolay<\/strong> ve <strong>kurumsal ortama uygun<\/strong> bir PowerShell yap\u0131s\u0131na d&ouml;n&uuml;\u015ft&uuml;rd&uuml;m.<\/p>\n<p>Bu yap\u0131:<\/p>\n<ul>\n<li>\n<p>Tek dosya olarak da &ccedil;al\u0131\u015f\u0131r<\/p>\n<\/li>\n<li>\n<p>\u0130stersen mod&uuml;l (<code>.psm1<\/code>) haline getirilebilir<\/p>\n<\/li>\n<li>\n<p>Domain \/ Standalone uyumlu<\/p>\n<\/li>\n<li>\n<p>Humanist (a&ccedil;\u0131klamal\u0131), ikon yok, sade dil<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h1>Windows SIEM Integration &ndash; Mod&uuml;ler PowerShell Paketi<\/h1>\n<h2>&nbsp;<\/h2>\n<ul>\n<li>\n<p>Gerekli <strong>grup &uuml;yeliklerini<\/strong> eklemek<\/p>\n<\/li>\n<li>\n<p><strong>Event Log<\/strong>, <strong>WMI<\/strong>, <strong>WinRM<\/strong> eri\u015fimini sa\u011flamak<\/p>\n<\/li>\n<li>\n<p>H\u0131zl\u0131 <strong>Health Check<\/strong> almak<\/p>\n<\/li>\n<li>\n<p>Tek komutla <strong>kur \/ kontrol et \/ raporla<\/strong><\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Dosya Yap\u0131s\u0131 (&ouml;nerilen)<\/h2>\n<pre><code class=\"language-text\">Windows-SIEM\/\n\u2502\n\u251c\u2500 SIEM-Config.ps1        # Ana &ccedil;al\u0131\u015ft\u0131rma dosyas\u0131\n\u251c\u2500 Modules\/\n\u2502   \u251c\u2500 Groups.ps1         # Grup i\u015flemleri\n\u2502   \u251c\u2500 EventLog.ps1       # Event Log eri\u015fimleri\n\u2502   \u251c\u2500 WMI.ps1            # WMI kontrolleri\n\u2502   \u251c\u2500 WinRM.ps1          # WinRM yap\u0131land\u0131rmas\u0131\n\u2502   \u2514\u2500 HealthCheck.ps1    # Test &amp; do\u011frulama\n\u2502\n\u2514\u2500 Config.psd1            # De\u011fi\u015fkenler\n<\/code><\/pre>\n<blockquote>\n<p>\u0130stersen bunu tek <code>.ps1<\/code> dosyas\u0131nda da birle\u015ftirebilirsin (a\u015fa\u011f\u0131da veriyorum).<\/p>\n<\/blockquote>\n<hr>\n<h2>Config.psd1 (Merkezi Ayarlar)<\/h2>\n<pre><code class=\"language-powershell\">@{\n    SIEMUser = \"siem_user\"\n\n    RequiredGroups = @(\n        \"Performance Monitor Users\",\n        \"Event Log Readers\",\n        \"Distributed COM Users\"\n    )\n\n    EventLogs = @(\n        \"Application\",\n        \"System\",\n        \"Security\"\n    )\n\n    WMINamespaces = @(\n        \"root\\cimv2\",\n        \"root\\wmi\"\n    )\n}\n<\/code><\/pre>\n<hr>\n<h2>Modules \/ Groups.ps1<\/h2>\n<pre><code class=\"language-powershell\">function Add-SIEMGroupMembership {\n    param ($User, $Groups)\n\n    foreach ($Group in $Groups) {\n        if (-not (Get-LocalGroupMember $Group -ErrorAction SilentlyContinue |\n                  Where-Object Name -like \"*$User\")) {\n\n            Add-LocalGroupMember -Group $Group -Member $User\n            Write-Host \"[OK] $User &rarr; $Group eklendi\"\n        }\n        else {\n            Write-Host \"[SKIP] $User zaten $Group &uuml;yesi\"\n        }\n    }\n}\n<\/code><\/pre>\n<hr>\n<h2>Modules \/ EventLog.ps1<\/h2>\n<pre><code class=\"language-powershell\">function Set-SIEMEventLogAccess {\n    param ($User, $Logs)\n\n    foreach ($Log in $Logs) {\n        $Path = \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\EventLog\\$Log\"\n        $Acl  = Get-Acl $Path\n\n        $Rule = New-Object System.Security.AccessControl.RegistryAccessRule(\n            $User,\n            \"ReadKey\",\n            \"ContainerInherit,ObjectInherit\",\n            \"None\",\n            \"Allow\"\n        )\n\n        $Acl.SetAccessRule($Rule)\n        Set-Acl -Path $Path -AclObject $Acl\n\n        Write-Host \"[OK] EventLog eri\u015fimi verildi &rarr; $Log\"\n    }\n}\n<\/code><\/pre>\n<hr>\n<h2>&nbsp;Modules \/ WMI.ps1<\/h2>\n<pre><code class=\"language-powershell\">function Test-SIEMWMI {\n    try {\n        Get-WmiObject Win32_OperatingSystem -ErrorAction Stop | Out-Null\n        Write-Host \"[OK] WMI eri\u015fimi mevcut\"\n        return $true\n    }\n    catch {\n        Write-Host \"[FAIL] WMI eri\u015fimi yok\"\n        return $false\n    }\n}\n<\/code><\/pre>\n<blockquote>\n<p>Not: WMI <strong>yetkilendirme i\u015flemi otomatik yap\u0131lmaz<\/strong>, g&uuml;venlik nedeniyle <strong>wmimgmt.msc<\/strong> &uuml;zerinden manuel yap\u0131lmas\u0131 &ouml;nerilir.<\/p>\n<\/blockquote>\n<hr>\n<h2>Modules \/ WinRM.ps1<\/h2>\n<pre><code class=\"language-powershell\">function Enable-SIEMWinRM {\n\n    if ((Get-Service WinRM).Status -ne \"Running\") {\n        winrm quickconfig -quiet\n        Set-Service WinRM -StartupType Automatic\n        Start-Service WinRM\n    }\n\n    Write-Host \"[OK] WinRM aktif\"\n}\n<\/code><\/pre>\n<hr>\n<h2>Modules \/ HealthCheck.ps1<\/h2>\n<pre><code class=\"language-powershell\">function Invoke-SIEMHealthCheck {\n    param ($User, $Groups)\n\n    Write-Host \"`n--- GROUP CHECK ---\"\n    foreach ($Group in $Groups) {\n        Get-LocalGroupMember $Group |\n        Where-Object Name -like \"*$User\" |\n        ForEach-Object { Write-Host \"[OK] $User &rarr; $Group\" }\n    }\n\n    Write-Host \"`n--- EVENT LOG TEST ---\"\n    Get-WinEvent -LogName System -MaxEvents 1 | Out-Null\n    Write-Host \"[OK] Event Log okunabiliyor\"\n\n    Write-Host \"`n--- WMI TEST ---\"\n    Test-SIEMWMI | Out-Null\n\n    Write-Host \"`n--- WINRM TEST ---\"\n    Test-NetConnection localhost -Port 5985 | Out-Null\n    Write-Host \"[OK] WinRM portu a&ccedil;\u0131k\"\n}\n<\/code><\/pre>\n<hr>\n<h2>&nbsp;Ana Dosya &ndash; SIEM-Config.ps1<\/h2>\n<pre><code class=\"language-powershell\">$BasePath = Split-Path $MyInvocation.MyCommand.Path\n\n. \"$BasePath\\Config.psd1\"\n. \"$BasePath\\Modules\\Groups.ps1\"\n. \"$BasePath\\Modules\\EventLog.ps1\"\n. \"$BasePath\\Modules\\WMI.ps1\"\n. \"$BasePath\\Modules\\WinRM.ps1\"\n. \"$BasePath\\Modules\\HealthCheck.ps1\"\n\nWrite-Host \"SIEM Entegrasyonu ba\u015fl\u0131yor...\"\n\nAdd-SIEMGroupMembership -User $SIEMUser -Groups $RequiredGroups\nSet-SIEMEventLogAccess -User $SIEMUser -Logs $EventLogs\nEnable-SIEMWinRM\nInvoke-SIEMHealthCheck -User $SIEMUser -Groups $RequiredGroups\n\nWrite-Host \"SIEM Entegrasyonu tamamland\u0131.\"\n<\/code><\/pre>\n<h2>&nbsp;Kullan\u0131m<\/h2>\n<pre><code class=\"language-powershell\">Set-ExecutionPolicy Bypass -Scope Process\n.\\SIEM-Config.ps1\n<\/code><\/pre>\n<hr>\n<h2>Kurumsal Notlar<\/h2>\n<ul>\n<li>\n<p>Bu yap\u0131 <strong>FortiSIEM, QRadar, Sentinel, Wazuh, Splunk<\/strong> ile uyumludur<\/p>\n<\/li>\n<li>\n<p>Domain ortam\u0131nda <strong>Local yerine Domain Group<\/strong> kullan\u0131labilir<\/p>\n<\/li>\n<\/ul>\n<p>extra<\/p>\n<pre class=\"language-markup\"><code>param(\n    [string]$SiemUser = \"siemuser\"\n)\n\nWrite-Host \"=== FortiSIEM Windows Entegrasyon Scripti ===\" -ForegroundColor Cyan\n\n# Domain mi kontrol et\n$IsDomain = (Get-WmiObject Win32_ComputerSystem).PartOfDomain\nWrite-Host \"Domain Ortam\u0131: $IsDomain\"\n\n# --- Local Group Ekleme ---\n$Groups = @(\n    \"Event Log Readers\",\n    \"Performance Monitor Users\",\n    \"Distributed COM Users\"\n)\n\nforeach ($group in $Groups) {\n    try {\n        Add-LocalGroupMember -Group $group -Member $SiemUser -ErrorAction Stop\n        Write-Host \"[OK] $SiemUser &rarr; $group\" -ForegroundColor Green\n    } catch {\n        Write-Host \"[WARN] $group eklenemedi veya zaten &uuml;ye\" -ForegroundColor Yellow\n    }\n}\n\n# --- WMI Namespace Yetkisi ---\n$namespace = \"root\\cimv2\"\n$account = \"$SiemUser\"\n\n$sd = Get-WmiObject -Namespace $namespace -Class __SystemSecurity\n$acl = $sd.GetSecurityDescriptor().Descriptor\n\nWrite-Host \"[OK] WMI eri\u015fimi mevcut (root\\cimv2)\" -ForegroundColor Green\n\n# --- WinRM A&ccedil; ---\nWrite-Host \"WinRM yap\u0131land\u0131r\u0131l\u0131yor...\"\nwinrm quickconfig -quiet\nSet-Service WinRM -StartupType Automatic\nStart-Service WinRM\n\n# --- Firewall ---\nWrite-Host \"Firewall WinRM kural\u0131 ekleniyor...\"\nEnable-NetFirewallRule -Name \"WINRM-HTTP-In-TCP\"\n\nWrite-Host \"=== Tamamland\u0131 ===\" -ForegroundColor Cyan\n<\/code><\/pre>\n<p>kontrol<\/p>\n<pre class=\"language-markup\"><code>Write-Host \"=== FortiSIEM Health Check ===\" -ForegroundColor Cyan\n\n# Security Log\ntry {\n    Get-WinEvent -LogName Security -MaxEvents 3 | Out-Null\n    Write-Host \"[OK] Security Log eri\u015fimi var\" -ForegroundColor Green\n} catch {\n    Write-Host \"[FAIL] Security Log eri\u015fimi yok\" -ForegroundColor Red\n}\n\n# WMI\ntry {\n    Get-WmiObject Win32_OperatingSystem | Out-Null\n    Write-Host \"[OK] WMI eri\u015fimi var\" -ForegroundColor Green\n} catch {\n    Write-Host \"[FAIL] WMI eri\u015fimi yok\" -ForegroundColor Red\n}\n\n# WinRM\nif ((Get-Service WinRM).Status -eq \"Running\") {\n    Write-Host \"[OK] WinRM &ccedil;al\u0131\u015f\u0131yor\" -ForegroundColor Green\n} else {\n    Write-Host \"[FAIL] WinRM &ccedil;al\u0131\u015fm\u0131yor\" -ForegroundColor Red\n}\n\n# Audit Policy\nauditpol \/get \/subcategory:\"File System\"\n<\/code><\/pre>\n<p>&nbsp;<\/p>","excerpt":"SIEM (Security Information and Event Management), g\u00fcvenlik olaylar\u0131n\u0131 merkezi olarak toplar, analiz eder ve raporlar. Windows sunuculardan SIEM\u2019e log g\u00f6nderimi, g\u00fcvenlik takibi ve tehdit tespitinde kritik rol oynar.","created_at":"2025-06-27 08:32:57","updated_at":"2026-09-07 17:41:15","category_id":6,"view_count":662,"reading_time":7,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-06-27 08:32:57","featured_image":"resimyok.jpg","slug":"windows-da-siem-entegrasyonu","category_name":"Sistem","category_slug":"sistem"}