{"action":"created","issue":{"url":"https://api.github.com/repos/wazuh/ossec-wazuh/issues/19","repository_url":"https://api.github.com/repos/wazuh/ossec-wazuh","labels_url":"https://api.github.com/repos/wazuh/ossec-wazuh/issues/19/labels{/name}","comments_url":"https://api.github.com/repos/wazuh/ossec-wazuh/issues/19/comments","events_url":"https://api.github.com/repos/wazuh/ossec-wazuh/issues/19/events","html_url":"https://github.com/wazuh/ossec-wazuh/issues/19","id":137642739,"number":19,"title":"Windows Event Logs","user":{"login":"elvarb","id":1716457,"avatar_url":"https://avatars.githubusercontent.com/u/1716457?v=3","gravatar_id":"","url":"https://api.github.com/users/elvarb","html_url":"https://github.com/elvarb","followers_url":"https://api.github.com/users/elvarb/followers","following_url":"https://api.github.com/users/elvarb/following{/other_user}","gists_url":"https://api.github.com/users/elvarb/gists{/gist_id}","starred_url":"https://api.github.com/users/elvarb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elvarb/subscriptions","organizations_url":"https://api.github.com/users/elvarb/orgs","repos_url":"https://api.github.com/users/elvarb/repos","events_url":"https://api.github.com/users/elvarb/events{/privacy}","received_events_url":"https://api.github.com/users/elvarb/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-03-01T17:53:58Z","updated_at":"2016-03-02T10:57:28Z","closed_at":null,"body":"The Wazuh fork is really promising but it comes with the flaw of ossec is that it handles Windows Event Logs rather badly. There is so much content in them that can help identify problems that is not parsed, for example any usernames, file paths, domains and so on.\r\n\r\nParsing every single possible event format is not the best course of action but possibly the only option. I know that Windows Event Logs have more meta data in them than you can view through the xml view. Ossec sadly is not aware of it so to bring Wazuah to a level above Ossec getting that detailed information is incredibly valuable.\r\n\r\nAre there any plans to modify the ossec client to get that information?"},"comment":{"url":"https://api.github.com/repos/wazuh/ossec-wazuh/issues/comments/191187807","html_url":"https://github.com/wazuh/ossec-wazuh/issues/19#issuecomment-191187807","issue_url":"https://api.github.com/repos/wazuh/ossec-wazuh/issues/19","id":191187807,"user":{"login":"elvarb","id":1716457,"avatar_url":"https://avatars.githubusercontent.com/u/1716457?v=3","gravatar_id":"","url":"https://api.github.com/users/elvarb","html_url":"https://github.com/elvarb","followers_url":"https://api.github.com/users/elvarb/followers","following_url":"https://api.github.com/users/elvarb/following{/other_user}","gists_url":"https://api.github.com/users/elvarb/gists{/gist_id}","starred_url":"https://api.github.com/users/elvarb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elvarb/subscriptions","organizations_url":"https://api.github.com/users/elvarb/orgs","repos_url":"https://api.github.com/users/elvarb/repos","events_url":"https://api.github.com/users/elvarb/events{/privacy}","received_events_url":"https://api.github.com/users/elvarb/received_events","type":"User","site_admin":false},"created_at":"2016-03-02T10:57:28Z","updated_at":"2016-03-02T10:57:28Z","body":"There is a similar open issue for Elastic's Winlogbeat https://github.com/elastic/beats/issues/465"}}