[{"id":383,"title":"Windows Sunucularda G\u00fcvenlik Analizi: Kullan\u0131c\u0131 Oturumlar\u0131n\u0131 \u0130zleme ve Raporlama","content":"<div id=\"model-response-message-contentr_9badafa2c860b643\" class=\"markdown markdown-main-panel stronger enable-updated-hr-color\" dir=\"ltr\" aria-live=\"polite\" aria-busy=\"false\">\n<p data-path-to-node=\"3\">&nbsp;<\/p>\n<p data-path-to-node=\"4\">Bu yaz\u0131m\u0131zda, Windows sunucular\u0131n\u0131zda kullan\u0131c\u0131 giri\u015flerini analiz etmek i&ccedil;in kullanabilece\u011finiz profesyonel y&ouml;ntemleri ele al\u0131yoruz.<\/p>\n<h3 data-path-to-node=\"5\">1. Event Viewer: Sistem G&uuml;nl&uuml;klerinin \"Kara Kutusu\"<\/h3>\n<p data-path-to-node=\"6\">Windows tabanl\u0131 sistemlerde ger&ccedil;ekle\u015fen her ba\u015far\u0131l\u0131 veya ba\u015far\u0131s\u0131z giri\u015f denemesi, G&uuml;venlik (Security) g&uuml;nl&uuml;klerine kaydedilir. Bir siber g&uuml;venlik analizi veya denetim s\u0131ras\u0131nda bakman\u0131z gereken ilk yer buras\u0131d\u0131r.<\/p>\n<ul data-path-to-node=\"7\">\n<li>\n<p data-path-to-node=\"7,0,0\"><strong data-path-to-node=\"7,0,0\" data-index-in-node=\"0\">Yol:<\/strong> <code data-path-to-node=\"7,0,0\" data-index-in-node=\"5\">Event Viewer &gt; Windows Logs &gt; Security<\/code><\/p>\n<\/li>\n<li>\n<p data-path-to-node=\"7,1,0\"><strong data-path-to-node=\"7,1,0\" data-index-in-node=\"0\">Filtreleme:<\/strong> Sa\u011f paneldeki \"Filter Current Log\" se&ccedil;ene\u011fine t\u0131klayarak <strong data-path-to-node=\"7,1,0\" data-index-in-node=\"69\">Event ID: 4624<\/strong> (Success Logon) kodunu arat\u0131n.<\/p>\n<\/li>\n<\/ul>\n<p>Kritik \u0130pucu: Logon Type Parametresi<\/p>\n<p>ID 4624 tek ba\u015f\u0131na yeterli de\u011fildir. Detaylar k\u0131sm\u0131ndaki \"Logon Type\" verisi, giri\u015fin t&uuml;r&uuml;n&uuml; s&ouml;yler:<\/p>\n<ul data-path-to-node=\"9\">\n<li>\n<p data-path-to-node=\"9,0,0\"><strong data-path-to-node=\"9,0,0\" data-index-in-node=\"0\">Type 2:<\/strong> Fiziksel klavye ve monit&ouml;r ba\u015f\u0131ndaki giri\u015f.<\/p>\n<\/li>\n<li>\n<p data-path-to-node=\"9,1,0\"><strong data-path-to-node=\"9,1,0\" data-index-in-node=\"0\">Type 3:<\/strong> A\u011f &uuml;zerinden (dosya payla\u015f\u0131m\u0131 gibi) eri\u015fim.<\/p>\n<\/li>\n<li>\n<p data-path-to-node=\"9,2,0\"><strong data-path-to-node=\"9,2,0\" data-index-in-node=\"0\">Type 10:<\/strong> En kritik olan\u0131d\u0131r; Uzak Masa&uuml;st&uuml; (RDP) ba\u011flant\u0131s\u0131n\u0131 temsil eder.<\/p>\n<\/li>\n<\/ul>\n<h3 data-path-to-node=\"10\">2. PowerShell ile H\u0131zl\u0131 Raporlama<\/h3>\n<p data-path-to-node=\"11\">Aray&uuml;z i&ccedil;inde kaybolmak yerine, PowerShell'in g&uuml;c&uuml;n&uuml; kullanarak son giri\u015f yapan kullan\u0131c\u0131lar\u0131 saniyeler i&ccedil;inde listeleyebilirsiniz. A\u015fa\u011f\u0131daki komut, sunucuya en son giri\u015f yapan 5 ba\u015far\u0131l\u0131 oturum a&ccedil;ma i\u015flemini kullan\u0131c\u0131 ad\u0131 ve zaman damgas\u0131yla getirir:<\/p>\n<!----><!----><!----><!----><!----><!----><!---->\n<div class=\"code-block ng-tns-c2721585414-85 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation\" data-hveid=\"0\" data-ved=\"0CAAQhtANahcKEwiqgOqIqIuSAxUAAAAAHQAAAAAQbg\">\n<div class=\"code-block-decoration header-formatted gds-title-s ng-tns-c2721585414-85 ng-star-inserted\"><span class=\"ng-tns-c2721585414-85\">PowerShell<\/span>\n<div class=\"buttons ng-tns-c2721585414-85 ng-star-inserted\"><button class=\"mdc-icon-button mat-mdc-icon-button mat-mdc-button-base mat-mdc-tooltip-trigger copy-button ng-tns-c2721585414-85 mat-unthemed _mat-animation-noopable ng-star-inserted\" aria-label=\"Kodu kopyala\"><\/button><!----><!----><\/div>\n<!----><\/div>\n<!---->\n<div class=\"formatted-code-block-internal-container ng-tns-c2721585414-85\">\n<div class=\"animated-opacity ng-tns-c2721585414-85\">\n<pre class=\"ng-tns-c2721585414-85\"><code class=\"code-container formatted ng-tns-c2721585414-85\" role=\"text\" data-test-id=\"code-content\"><span class=\"hljs-built_in\">Get-EventLog<\/span> <span class=\"hljs-literal\">-LogName<\/span> Security <span class=\"hljs-literal\">-InstanceId<\/span> <span class=\"hljs-number\">4624<\/span> <span class=\"hljs-literal\">-Newest<\/span> <span class=\"hljs-number\">5<\/span> | \n<span class=\"hljs-built_in\">Select-Object<\/span> TimeGenerated, <span class=\"hljs-selector-tag\">@<\/span>{Name=<span class=\"hljs-string\">\"User\"<\/span>; Expression={<span class=\"hljs-variable\">$_<\/span>.ReplacementStrings[<span class=\"hljs-number\">5<\/span>]}}\n<\/code><\/pre>\n<!----><\/div>\n<\/div>\n<\/div>\n<!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!---->\n<p data-path-to-node=\"13\">Bu y&ouml;ntem, &ouml;zellikle rutin kontroller s\u0131ras\u0131nda zaman kazanman\u0131z\u0131 sa\u011flar.<\/p>\n<h3 data-path-to-node=\"14\">3. \"quser\" Komutu: Anl\u0131k Durum Analizi<\/h3>\n<p data-path-to-node=\"15\">Sunucunuzun performans\u0131nda bir yava\u015flama hissetti\u011finizde veya \"Uzak masa&uuml;st&uuml; kullan\u0131c\u0131 s\u0131n\u0131r\u0131na ula\u015f\u0131ld\u0131\" hatas\u0131 ald\u0131\u011f\u0131n\u0131zda, o an kimlerin sistemde oldu\u011funu bilmeniz gerekir.<\/p>\n<p data-path-to-node=\"16\">Terminali (CMD veya PowerShell) a&ccedil;\u0131n ve sadece <code data-path-to-node=\"16\" data-index-in-node=\"47\">quser<\/code> yaz\u0131n. Bu komut size \u015fu bilgileri verir:<\/p>\n<ul data-path-to-node=\"17\">\n<li>\n<p data-path-to-node=\"17,0,0\">Aktif kullan\u0131c\u0131 adlar\u0131.<\/p>\n<\/li>\n<li>\n<p data-path-to-node=\"17,1,0\">Oturumun durumu (Active \/ Disconnected).<\/p>\n<\/li>\n<li>\n<p data-path-to-node=\"17,2,0\">Oturumun ba\u015flang\u0131&ccedil; saati.<\/p>\n<\/li>\n<\/ul>\n<p data-path-to-node=\"18\"><em data-path-to-node=\"18\" data-index-in-node=\"0\">E\u011fer bir kullan\u0131c\u0131 oturumunu kapatmak yerine sadece pencereyi &ccedil;arpt\u0131ysa, oturumu \"Disconnected\" olarak g&ouml;receksiniz. Bu durum gereksiz kaynak t&uuml;ketimine neden olabilir.<\/em><\/p>\n<h3 data-path-to-node=\"19\">4. Kay\u0131t Defteri (Registry) &Uuml;zerinden Son Kullan\u0131c\u0131 Kontrol&uuml;<\/h3>\n<p>Sunucuda en son hangi kullan\u0131c\u0131n\u0131n i\u015flem yapt\u0131\u011f\u0131n\u0131 h\u0131zl\u0131ca g&ouml;rmek i&ccedil;in Registry kay\u0131tlar\u0131na da g&ouml;z atabilirsiniz:<\/p>\n<p>HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\LogonUI<\/p>\n<p data-path-to-node=\"21\">Buradaki <strong data-path-to-node=\"21\" data-index-in-node=\"9\">LastLoggedOnUser<\/strong> anahtar\u0131, sistemin haf\u0131zas\u0131ndaki son kullan\u0131c\u0131 bilgisini statik olarak tutar.<\/p>\n<p data-path-to-node=\"21\">&nbsp;<\/p>\n<div id=\"model-response-message-contentr_14680a3defe63e45\" class=\"markdown markdown-main-panel stronger enable-updated-hr-color\" dir=\"ltr\" aria-live=\"polite\" aria-busy=\"false\">\n<p data-path-to-node=\"0\">blog yaz\u0131s\u0131nda bahsetti\u011fim y&ouml;ntemleri (Event Viewer analizi, aktif kullan\u0131c\u0131 sorgulama ve son giri\u015f yapan kullan\u0131c\u0131y\u0131 g&ouml;rme) tek bir aray&uuml;zde birle\u015ftiren, kullan\u0131m\u0131 kolay bir <strong data-path-to-node=\"0\" data-index-in-node=\"190\">PowerShell GUI<\/strong> haz\u0131rlad\u0131m.<\/p>\n<p data-path-to-node=\"1\">Bu ara&ccedil;; RDP giri\u015flerini (Logon Type 10), fiziksel giri\u015fleri ve anl\u0131k aktif kullan\u0131c\u0131lar\u0131 tek t\u0131kla listeler.<\/p>\n<h3 data-path-to-node=\"2\">PowerShell GUI Kodu<\/h3>\n<p data-path-to-node=\"3\">A\u015fa\u011f\u0131daki kodu bir <code data-path-to-node=\"3\" data-index-in-node=\"19\">.ps1<\/code> dosyas\u0131 olarak kaydedip (&ouml;rne\u011fin: <code data-path-to-node=\"3\" data-index-in-node=\"58\">OturumIzleme.ps1<\/code>) sa\u011f t\u0131klay\u0131p \"PowerShell ile &Ccedil;al\u0131\u015ft\u0131r\" diyebilirsiniz:<\/p>\n<!----><!----><!----><!----><!----><!----><!---->\n<div class=\"code-block ng-tns-c2721585414-94 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation\" data-hveid=\"0\" data-ved=\"0CAAQhtANahgKEwiqgOqIqIuSAxUAAAAAHQAAAAAQgwE\">\n<div class=\"formatted-code-block-internal-container ng-tns-c2721585414-94\">\n<div class=\"animated-opacity ng-tns-c2721585414-94\">\n<pre class=\"ng-tns-c2721585414-94\">&nbsp;<\/pre>\n<pre class=\"language-markup\"><code># Gerekli k&uuml;t&uuml;phaneleri y&uuml;kle\nAdd-Type -AssemblyName System.Windows.Forms\nAdd-Type -AssemblyName System.Drawing\n\n# Ana Form Ayarlar\u0131\n$form = New-Object System.Windows.Forms.Form\n$form.Text = \"Ondernet - Windows Oturum \u0130zleme Paneli\"\n$form.Size = New-Object System.Drawing.Size(850, 650)\n$form.StartPosition = \"CenterScreen\"\n$form.BackColor = \"#F8F9FA\"\n$form.Font = New-Object System.Drawing.Font(\"Segoe UI\", 9)\n\n# Ba\u015fl\u0131k Etiketi\n$label = New-Object System.Windows.Forms.Label\n$label.Text = \"Sunucu Eri\u015fim ve G&uuml;venlik Analizi\"\n$label.Location = New-Object System.Drawing.Point(20, 15)\n$label.Size = New-Object System.Drawing.Size(400, 30)\n$label.Font = New-Object System.Drawing.Font(\"Segoe UI\", 16, [System.Drawing.FontStyle]::Bold)\n$label.ForeColor = \"#212529\"\n$form.Controls.Add($label)\n\n# Veri Tablosu (DataGridView)\n$dataGridView = New-Object System.Windows.Forms.DataGridView\n$dataGridView.Location = New-Object System.Drawing.Point(20, 110)\n$dataGridView.Size = New-Object System.Drawing.Size(790, 430)\n$dataGridView.AutoSizeColumnsMode = \"Fill\"\n$dataGridView.BackgroundColor = \"White\"\n$dataGridView.BorderStyle = \"None\"\n$dataGridView.RowHeadersVisible = $false\n$dataGridView.ReadOnly = $true\n$dataGridView.SelectionMode = \"FullRowSelect\"\n$dataGridView.AlternatingRowsDefaultCellStyle.BackColor = \"#F2F2F2\"\n$form.Controls.Add($dataGridView)\n\n# Fonksiyon: Veriyi Grid'e G&uuml;venli Basma\nfunction Update-Grid {\n    param($DataList)\n    $arrayList = New-Object System.Collections.ArrayList\n    if ($DataList) {\n        $arrayList.AddRange($DataList)\n    }\n    $dataGridView.DataSource = $arrayList\n}\n\n# 1. Buton: Aktif Kullan\u0131c\u0131lar (quser)\n$btnQuser = New-Object System.Windows.Forms.Button\n$btnQuser.Text = \"Anl\u0131k Aktif Kullan\u0131c\u0131lar\"\n$btnQuser.Location = New-Object System.Drawing.Point(20, 60)\n$btnQuser.Size = New-Object System.Drawing.Size(250, 40)\n$btnQuser.BackColor = \"#0078D7\"\n$btnQuser.ForeColor = \"White\"\n$btnQuser.FlatStyle = \"Flat\"\n$btnQuser.Cursor = [System.Windows.Forms.Cursors]::Hand\n$btnQuser.Add_Click({\n    # quser &ccedil;\u0131kt\u0131s\u0131n\u0131 g&uuml;venli bir \u015fekilde diziye al (tek sonu&ccedil; olsa bile)\n    $rawOutput = @(quser 2&gt;$null)\n    \n    if ($rawOutput.Count -gt 0) {\n        $data = @($rawOutput | Select-Object -Skip 1 | ForEach-Object {\n            # Bo\u015fluklara g&ouml;re b&ouml;l ve temizle\n            $line = $_.Trim() -split '\\s{2,}'\n            [PSCustomObject]@{\n                Kullanici    = $line[0].Replace(\"&gt;\",\"\") # Aktif kullan\u0131c\u0131 imlecini temizle\n                Oturum_Adi   = if($line[1] -match '^\\d+$') { \"RDP\/None\" } else { $line[1] }\n                ID           = if($line[1] -match '^\\d+$') { $line[1] } else { $line[2] }\n                Durum        = if($line[1] -match '^\\d+$') { $line[2] } else { $line[3] }\n                Giris_Zamani = if($line[1] -match '^\\d+$') { $line[4] } else { $line[5] }\n            }\n        })\n        Update-Grid -DataList $data\n    } else {\n        [System.Windows.Forms.MessageBox]::Show(\"Aktif oturum bulunamad\u0131 veya yetki yetersiz.\", \"Bilgi\")\n    }\n})\n$form.Controls.Add($btnQuser)\n\n# 2. Buton: Son 15 Ba\u015far\u0131l\u0131 Giri\u015f (Event Log)\n$btnLogon = New-Object System.Windows.Forms.Button\n$btnLogon.Text = \"Son 15 Ba\u015far\u0131l\u0131 Giri\u015f (Event Log)\"\n$btnLogon.Location = New-Object System.Drawing.Point(285, 60)\n$btnLogon.Size = New-Object System.Drawing.Size(250, 40)\n$btnLogon.BackColor = \"#28A745\"\n$btnLogon.ForeColor = \"White\"\n$btnLogon.FlatStyle = \"Flat\"\n$btnLogon.Cursor = [System.Windows.Forms.Cursors]::Hand\n$btnLogon.Add_Click({\n    try {\n        $events = @(Get-WinEvent -FilterHashtable @{LogName='Security';ID=4624} -MaxEvents 15 -ErrorAction SilentlyContinue | ForEach-Object {\n            [PSCustomObject]@{\n                Tarih_Saat  = $_.TimeCreated\n                Kullanici   = $_.Properties[5].Value\n                Logon_Tipi  = $_.Properties[8].Value # Tip 10: RDP, Tip 2: Yerel\n                Kaynak_IP   = $_.Properties[18].Value\n            }\n        })\n        Update-Grid -DataList $events\n    } catch {\n        [System.Windows.Forms.MessageBox]::Show(\"Olay g&uuml;nl&uuml;kleri okunurken hata olu\u015ftu. Y&ouml;netici olarak &ccedil;al\u0131\u015ft\u0131rd\u0131\u011f\u0131n\u0131zdan emin olun.\", \"Hata\")\n    }\n})\n$form.Controls.Add($btnLogon)\n\n# 3. Buton: Registry Son Kullan\u0131c\u0131 Bilgisi\n$btnReg = New-Object System.Windows.Forms.Button\n$btnReg.Text = \"Kay\u0131t Defteri (Son Kay\u0131t)\"\n$btnReg.Location = New-Object System.Drawing.Point(550, 60)\n$btnReg.Size = New-Object System.Drawing.Size(250, 40)\n$btnReg.BackColor = \"#6C757D\"\n$btnReg.ForeColor = \"White\"\n$btnReg.FlatStyle = \"Flat\"\n$btnReg.Cursor = [System.Windows.Forms.Cursors]::Hand\n$btnReg.Add_Click({\n    $regPath = \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\LogonUI\"\n    $lastUser = (Get-ItemProperty -Path $regPath -ErrorAction SilentlyContinue).LastLoggedOnUser\n    if ($lastUser) {\n        [System.Windows.Forms.MessageBox]::Show(\"Windows Kay\u0131t Defterine G&ouml;re Son Giri\u015f Yapan:`n`n$lastUser\", \"Registry Bilgisi\")\n    } else {\n        [System.Windows.Forms.MessageBox]::Show(\"Bilgi al\u0131namad\u0131.\", \"Hata\")\n    }\n})\n$form.Controls.Add($btnReg)\n\n# Alt Bilgi (Footer)\n$footer = New-Object System.Windows.Forms.Label\n$footer.Text = \"&copy; 2024 Ondernet.net - Sunucu G&uuml;venlik Analiz Arac\u0131\"\n$footer.Location = New-Object System.Drawing.Point(20, 560)\n$footer.Size = New-Object System.Drawing.Size(500, 20)\n$footer.ForeColor = \"Gray\"\n$form.Controls.Add($footer)\n\n# Formu G&ouml;ster\n[void]$form.ShowDialog()<\/code><\/pre>\n<pre class=\"ng-tns-c2721585414-94\"><code class=\"code-container formatted ng-tns-c2721585414-94\" role=\"text\" data-test-id=\"code-content\">\n<\/code><\/pre>\n<!----><\/div>\n<\/div>\n<\/div>\n<!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!---->\n<h3 data-path-to-node=\"5\">Ara&ccedil; Neleri Kaps\u0131yor?<\/h3>\n<ol start=\"1\" data-path-to-node=\"6\">\n<li>\n<p data-path-to-node=\"6,0,0\"><strong data-path-to-node=\"6,0,0\" data-index-in-node=\"0\">Anl\u0131k Aktif Kullan\u0131c\u0131lar (quser):<\/strong> Sunucuda o anda \"Active\" veya \"Disconnected\" durumda olan t&uuml;m kullan\u0131c\u0131lar\u0131, oturum ID'leri ve giri\u015f saatleriyle birlikte tabloya d&ouml;ker.<\/p>\n<\/li>\n<li>\n<p data-path-to-node=\"6,1,0\"><strong data-path-to-node=\"6,1,0\" data-index-in-node=\"0\">Son 10 Giri\u015f (Event ID 4624):<\/strong> G&uuml;venlik g&uuml;nl&uuml;klerini tarar. Kullan\u0131c\u0131 ad\u0131n\u0131n yan\u0131 s\u0131ra, blog yaz\u0131s\u0131nda kritik oldu\u011fu belirtilen <strong data-path-to-node=\"6,1,0\" data-index-in-node=\"127\">Logon Type<\/strong> ve <strong data-path-to-node=\"6,1,0\" data-index-in-node=\"141\">Kaynak IP<\/strong> bilgilerini g&ouml;sterir (&Ouml;rn: Type 10 g&ouml;r&uuml;yorsan\u0131z RDP ile giri\u015ftir).<\/p>\n<\/li>\n<li>\n<p data-path-to-node=\"6,2,0\"><strong data-path-to-node=\"6,2,0\" data-index-in-node=\"0\">Registry Bilgisi:<\/strong> Windows'un kay\u0131t defterinde tuttu\u011fu \"son giri\u015f yapan kullan\u0131c\u0131\" bilgisini k&uuml;&ccedil;&uuml;k bir pop-up mesaj\u0131 olarak ekrana getirir.<\/p>\n<\/li>\n<\/ol>\n<h3 data-path-to-node=\"7\">&Ccedil;al\u0131\u015ft\u0131rmadan &Ouml;nce Notlar:<\/h3>\n<ul data-path-to-node=\"8\">\n<li>\n<p data-path-to-node=\"8,0,0\"><strong data-path-to-node=\"8,0,0\" data-index-in-node=\"0\">Y&ouml;netici Yetkisi:<\/strong> <code data-path-to-node=\"8,0,0\" data-index-in-node=\"18\">Security<\/code> loglar\u0131n\u0131 okumak ve <code data-path-to-node=\"8,0,0\" data-index-in-node=\"47\">quser<\/code> komutunu &ccedil;al\u0131\u015ft\u0131rmak i&ccedil;in PowerShell'i <strong data-path-to-node=\"8,0,0\" data-index-in-node=\"92\">Y&ouml;netici Olarak &Ccedil;al\u0131\u015ft\u0131r<\/strong> se&ccedil;ene\u011fiyle a&ccedil;mal\u0131s\u0131n\u0131z.<\/p>\n<\/li>\n<li>\n<p data-path-to-node=\"8,1,0\"><strong data-path-to-node=\"8,1,0\" data-index-in-node=\"0\">Execution Policy:<\/strong> E\u011fer script &ccedil;al\u0131\u015fmazsa, terminale <code data-path-to-node=\"8,1,0\" data-index-in-node=\"52\">Set-ExecutionPolicy RemoteSigned -Scope CurrentUser<\/code> komutunu yazarak izin verebilirsiniz.<\/p>\n<\/li>\n<\/ul>\n<\/div>\n<hr data-path-to-node=\"22\">\n<h3 data-path-to-node=\"23\">Ondernet &Ouml;nerisi: Neden \u0130zleme Yapmal\u0131s\u0131n\u0131z?<\/h3>\n<p data-path-to-node=\"24\">Sistem g&uuml;venli\u011fi sadece d\u0131\u015far\u0131dan gelen sald\u0131r\u0131lara kar\u015f\u0131 barikat kurmak de\u011fildir. \u0130&ccedil;erideki hareketlili\u011fi izlemek, yetkisiz eri\u015fimleri erkenden tespit etmenize ve olas\u0131 bir hata durumunda \"sorumlu hesab\u0131\" h\u0131zl\u0131ca bulman\u0131za olanak tan\u0131r.<\/p>\n<p data-path-to-node=\"25\"><strong data-path-to-node=\"25\" data-index-in-node=\"0\">Sunucu g&uuml;venli\u011finizi bir &uuml;st seviyeye ta\u015f\u0131mak m\u0131 istiyorsunuz?<\/strong> Y&uuml;ksek performansl\u0131 ve g&uuml;venli <strong data-path-to-node=\"25\" data-index-in-node=\"94\">Windows VDS<\/strong> &ccedil;&ouml;z&uuml;mlerimizle tan\u0131\u015fmak i&ccedil;in <!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><a class=\"ng-star-inserted\" href=\"..\/..\/\" target=\"_blank\" rel=\"noopener\" data-hveid=\"0\" data-ved=\"0CAAQ_4QMahcKEwiqgOqIqIuSAxUAAAAAHQAAAAAQbw\">Ondernet.net<\/a><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----><!----> adresini ziyaret edebilir, uzman ekibimizden destek alabilirsiniz.<\/p>\n<hr data-path-to-node=\"26\">\n<p data-path-to-node=\"27\"><em data-path-to-node=\"27\" data-index-in-node=\"0\">Bu yaz\u0131, sistem y&ouml;neticilerinin g&uuml;nl&uuml;k operasyonlar\u0131n\u0131 kolayla\u015ft\u0131rmak ve g&uuml;venlik fark\u0131ndal\u0131\u011f\u0131n\u0131 art\u0131rmak amac\u0131yla haz\u0131rlanm\u0131\u015ft\u0131r.<\/em><\/p>\n<\/div>","excerpt":"Sunucu y\u00f6netimi sadece servislerin ayakta kalmas\u0131n\u0131 sa\u011flamak de\u011fil, ayn\u0131 zamanda sistemin \"kim taraf\u0131ndan, ne zaman ve nas\u0131l\" kullan\u0131ld\u0131\u011f\u0131n\u0131 takip etmektir. \u00d6zellikle \u00e7ok kullan\u0131c\u0131l\u0131 Windows Sunucu ortamlar\u0131nda veya uzak masa\u00fcst\u00fc (RDP) trafi\u011finin yo\u011fun oldu\u011fu yap\u0131larda, oturum izleme operasyonel g\u00fcvenli\u011fin temel ta\u015f\u0131d\u0131r.","created_at":"2026-01-14 20:03:49","updated_at":"2026-09-08 04:02:21","category_id":9,"view_count":545,"reading_time":8,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2026-01-14 17:03:49","featured_image":"\/uploads\/images\/2026\/01\/6967cc5d11958_1768410205.png","slug":"windows-sunucularda-guvenlik-analizi-kullanici-oturumlarini-izleme-ve-raporlama","category_name":"Yaz\u0131l\u0131m","category_slug":"yazilim","category_color":"#ef4444"},{"id":71,"title":"\u00d6nemli Windows Event Log SIEM Kullan\u0131m Senaryolar\u0131","content":"<p>Windows Event Loglar\u0131, g&uuml;venlik operasyonlar\u0131 ve SIEM (Security Information and Event Management) &ccedil;&ouml;z&uuml;mleri i&ccedil;in kritik &ouml;neme sahiptir. Bu loglar, sald\u0131r\u0131 tespiti, uyumluluk izleme ve a\u011f g&uuml;venli\u011fi analizleri i&ccedil;in kullan\u0131labilir. A\u015fa\u011f\u0131da, Windows Event ID'lerine dayal\u0131 <strong>&nbsp;&ouml;nemli SIEM kullan\u0131m senaryosunu<\/strong>&nbsp;bulabilirsiniz.<\/p>\r\n<h2><strong>1. Kimlik Do\u011frulama ve Eri\u015fim Kontrol&uuml;<\/strong><\/h2>\r\n<ol start=\"1\">\r\n<li>\r\n<p><strong>Ba\u015far\u0131s\u0131z Giri\u015f Denemeleri<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>4625<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Hesap Kilitlemeleri<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>4740<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>&Ccedil;al\u0131\u015fma Saatleri D\u0131\u015f\u0131nda Ba\u015far\u0131l\u0131 Giri\u015f<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>4624<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Yeni Kullan\u0131c\u0131 Olu\u015fturma<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>4720<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Ayr\u0131cal\u0131kl\u0131 Hesap Kullan\u0131m\u0131<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>4672<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Kullan\u0131c\u0131 Hesab\u0131 De\u011fi\u015fiklikleri<\/strong>&nbsp;&ndash; Event IDs:&nbsp;<strong>4722, 4723, 4724, 4725, 4726<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Al\u0131\u015f\u0131lmad\u0131k Konumlardan Giri\u015f<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>4624<\/strong>&nbsp;(Co\u011frafi konum analizi ile)<\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>\u015eifre De\u011fi\u015fiklikleri<\/strong>&nbsp;&ndash; Event IDs:&nbsp;<strong>4723<\/strong>&nbsp;(de\u011fi\u015fiklik denemesi),&nbsp;<strong>4724<\/strong>&nbsp;(ba\u015far\u0131l\u0131 s\u0131f\u0131rlama)<\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Grup &Uuml;yelik De\u011fi\u015fiklikleri<\/strong>&nbsp;&ndash; Event IDs:&nbsp;<strong>4727, 4731, 4735, 4737<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>\u015e&uuml;pheli Giri\u015f Desenleri<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>4624<\/strong>&nbsp;(anormal giri\u015fler)<\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>A\u015f\u0131r\u0131 Giri\u015f Ba\u015far\u0131s\u0131zl\u0131klar\u0131<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>4625<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Devre D\u0131\u015f\u0131 B\u0131rak\u0131lm\u0131\u015f Hesap Aktivitesi<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>4725<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Uzun S&uuml;redir Kullan\u0131lmayan Hesaplar\u0131n Aktivitesi<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>4624<\/strong>&nbsp;(nadiren kullan\u0131lan hesaplar)<\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Servis Hesab\u0131 Aktivitesi<\/strong>&nbsp;&ndash; Event IDs:&nbsp;<strong>4624, 4672<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>RDP Eri\u015fim \u0130zleme<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>4624<\/strong>&nbsp;(RDP filtreleme ile)<\/p>\r\n<\/li>\r\n<\/ol>\r\n<h2><strong>2. A\u011f ve Sistem Hareketleri<\/strong><\/h2>\r\n<ol start=\"16\">\r\n<li>\r\n<p><strong>Yanal Hareket Tespiti<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>4648<\/strong>&nbsp;(a\u011f giri\u015fleri)<\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Dosya ve Klas&ouml;r Eri\u015fimi<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>4663<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Yetkisiz Dosya Payla\u015f\u0131m\u0131<\/strong>&nbsp;&ndash; Event IDs:&nbsp;<strong>5140, 5145<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Kay\u0131t Defteri De\u011fi\u015fiklikleri<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>4657<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Uygulama Y&uuml;kleme ve Kald\u0131rma<\/strong>&nbsp;&ndash; Event IDs:&nbsp;<strong>11707, 1033<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>USB Cihaz Kullan\u0131m\u0131<\/strong>&nbsp;&ndash; Event IDs:&nbsp;<strong>20001, 20003<\/strong>&nbsp;(Cihaz Y&ouml;netimi loglar\u0131ndan)<\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Windows G&uuml;venlik Duvar\u0131 De\u011fi\u015fiklikleri<\/strong>&nbsp;&ndash; Event IDs:&nbsp;<strong>4946, 4947, 4950, 4951<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Zamanlanm\u0131\u015f G&ouml;rev Olu\u015fturma<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>4698<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Proses &Ccedil;al\u0131\u015ft\u0131rma \u0130zleme<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>4688<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Sistem Yeniden Ba\u015flatma veya Kapatma<\/strong>&nbsp;&ndash; Event IDs:&nbsp;<strong>6005, 6006, 1074<\/strong><\/p>\r\n<\/li>\r\n<\/ol>\r\n<h2><strong>3. G&uuml;venlik \u0130hlali ve Log Manip&uuml;lasyonu<\/strong><\/h2>\r\n<ol start=\"26\">\r\n<li>\r\n<p><strong>Event Log Temizleme<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>1102<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>K&ouml;t&uuml; Ama&ccedil;l\u0131 Yaz\u0131l\u0131m &Ccedil;al\u0131\u015ft\u0131rma<\/strong>&nbsp;&ndash; Event IDs:&nbsp;<strong>4688, 1116<\/strong>&nbsp;(Windows Defender loglar\u0131ndan)<\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Active Directory De\u011fi\u015fiklikleri<\/strong>&nbsp;&ndash; Event IDs:&nbsp;<strong>5136, 5141<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Shadow Copy Silinmesi<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>524<\/strong>&nbsp;(VSSAdmin loglar\u0131 ile)<\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>A\u011f Yap\u0131land\u0131rma De\u011fi\u015fiklikleri<\/strong>&nbsp;&ndash; Event IDs:&nbsp;<strong>4254, 4255, 10400<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>\u015e&uuml;pheli Script &Ccedil;al\u0131\u015ft\u0131rma<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>4688<\/strong>&nbsp;(script yorumlay\u0131c\u0131 ile proses olu\u015fturma)<\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Servis Y&uuml;kleme veya De\u011fi\u015ftirme<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>4697<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Denetim Loglar\u0131n\u0131n Temizlenmesi<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>1102<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Yaz\u0131l\u0131m K\u0131s\u0131tlama Politikas\u0131 \u0130hlali<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>865<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>A\u015f\u0131r\u0131 Hesap Numaraland\u0131rma<\/strong>&nbsp;&ndash; Event IDs:&nbsp;<strong>4625, 4776<\/strong><\/p>\r\n<\/li>\r\n<\/ol>\r\n<h2><strong>4. Geli\u015fmi\u015f Tehdit Tespiti<\/strong><\/h2>\r\n<ol start=\"36\">\r\n<li>\r\n<p><strong>Hassas Dosyalara Eri\u015fim Denemesi<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>4663<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Al\u0131\u015f\u0131lmad\u0131k Proses Enjeksiyonu<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>4688<\/strong>&nbsp;(EDR veya Sysmon verisi ile)<\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>S&uuml;r&uuml;c&uuml; Y&uuml;kleme<\/strong>&nbsp;&ndash; Event IDs:&nbsp;<strong>7045<\/strong>&nbsp;(Service Control Manager)<\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Zamanlanm\u0131\u015f G&ouml;rev De\u011fi\u015fiklikleri<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>4699<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Yetkisiz GPO De\u011fi\u015fiklikleri<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>5136<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>\u015e&uuml;pheli PowerShell Aktivitesi<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>4104<\/strong>&nbsp;(PowerShell loglar\u0131ndan)<\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Al\u0131\u015f\u0131lmad\u0131k A\u011f Ba\u011flant\u0131lar\u0131<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>5156<\/strong>&nbsp;(a\u011f filtreleme platformu)<\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Payla\u015f\u0131lan Dosyalara Yetkisiz Eri\u015fim<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>5145<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Zararl\u0131 Domain DNS Sorgusu<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>5158<\/strong>&nbsp;(DNS loglar\u0131 gerektirir)<\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>LDAP Arama \u0130stismar\u0131<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>4662<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Proses Sonland\u0131rma \u0130zleme<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>4689<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Servis Ba\u015flatma Ba\u015far\u0131s\u0131zl\u0131klar\u0131<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>7041<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Denetim Politikas\u0131 De\u011fi\u015fiklikleri<\/strong>&nbsp;&ndash; Event IDs:&nbsp;<strong>4719, 1102<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>Zaman De\u011fi\u015fikli\u011fi \u0130zleme<\/strong>&nbsp;&ndash; Event IDs:&nbsp;<strong>4616, 520<\/strong><\/p>\r\n<\/li>\r\n<li>\r\n<p><strong>BitLocker \u015eifreleme Anahtar\u0131 De\u011fi\u015fiklikleri<\/strong>&nbsp;&ndash; Event ID:&nbsp;<strong>5379<\/strong><\/p>\r\n<\/li>\r\n<\/ol>\r\n<p>Windows Event Loglar\u0131, SIEM &ccedil;&ouml;z&uuml;mleriyle entegre edilerek g&uuml;venlik tehditlerini tespit etmek i&ccedil;in kullan\u0131labilir. Yukar\u0131daki <strong>kullan\u0131m senaryosu<\/strong>, kurulu\u015flar\u0131n olas\u0131 sald\u0131r\u0131lar\u0131 ve anormal aktiviteleri belirlemesine yard\u0131mc\u0131 olur. Bu loglar\u0131 d&uuml;zenli olarak izlemek ve analiz etmek, siber g&uuml;venlik post&uuml;r&uuml;n&uuml; g&uuml;&ccedil;lendirmek i&ccedil;in kritik &ouml;neme sahiptir. <strong>Kaynaklar:<\/strong><\/p>\r\n<ul>\r\n<li>Microsoft G&uuml;venlik Olay Kimlikleri Belgesi<\/li>\r\n<li>MITRE ATT&amp;CK Framework<\/li>\r\n<li>SIEM En \u0130yi Uygulama K\u0131lavuzlar\u0131<\/li>\r\n<\/ul>","excerpt":"Windows Event Loglar\u0131, g\u00fcvenlik operasyonlar\u0131 ve SIEM (Security Information and Event Management) \u00e7\u00f6z\u00fcmleri i\u00e7in kritik \u00f6neme sahiptir. Bu...","created_at":"2025-05-03 10:09:54","updated_at":"2026-09-06 16:54:33","category_id":7,"view_count":993,"reading_time":4,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-05-03 10:09:54","featured_image":"resimyok.jpg","slug":"onemli-windows-event-log-siem-kullanim-senaryolari","category_name":"Cyber Security","category_slug":"cyber-security","category_color":"#10b981"}]