{"action":"created","issue":{"url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2825","repository_url":"https://api.github.com/repos/Graylog2/graylog2-server","labels_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2825/labels{/name}","comments_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2825/comments","events_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2825/events","html_url":"https://github.com/Graylog2/graylog2-server/issues/2825","id":176850021,"number":2825,"title":"CEF UDP Plugin does not handle non-standard (other than Application, Security, System) in post-Vista Windows forwarded by OSSEC Server.","user":{"login":"gjahchan","id":22189754,"avatar_url":"https://avatars.githubusercontent.com/u/22189754?v=3","gravatar_id":"","url":"https://api.github.com/users/gjahchan","html_url":"https://github.com/gjahchan","followers_url":"https://api.github.com/users/gjahchan/followers","following_url":"https://api.github.com/users/gjahchan/following{/other_user}","gists_url":"https://api.github.com/users/gjahchan/gists{/gist_id}","starred_url":"https://api.github.com/users/gjahchan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gjahchan/subscriptions","organizations_url":"https://api.github.com/users/gjahchan/orgs","repos_url":"https://api.github.com/users/gjahchan/repos","events_url":"https://api.github.com/users/gjahchan/events{/privacy}","received_events_url":"https://api.github.com/users/gjahchan/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-09-14T08:48:58Z","updated_at":"2016-09-19T09:36:57Z","closed_at":"2016-09-19T09:36:57Z","body":"<!--- Provide a general summary of the issue in the Title above -->\r\nWindows event logs other than the Application, Security and System logs in post-Vista flavors of Windows are silently dropped by the CEF UDP Plugin in Graylog2.\r\n\r\n## Expected Behavior\r\n<!--- If you're describing a bug, tell us what should happen -->\r\nThese events should be logged, much like any other event picked up by the CEF UDP plugin from OSSEC alerts.json file.\r\n\r\n<!--- If you're suggesting a change/improvement, tell us how it should work -->\r\n\r\n## Current Behavior\r\n<!--- If describing a bug, tell us what happens instead of the expected behavior -->\r\n<!--- If suggesting a change/improvement, explain the difference from current behavior -->\r\n\r\n## Possible Solution\r\n<!--- Not obligatory, but suggest a fix/reason for the bug, -->\r\n<!--- or ideas how to implement the addition or change -->\r\n\r\n## Steps to Reproduce (for bugs)\r\n<!--- Provide a link to a live example, or an unambiguous set of steps to -->\r\nI will use an AppLocker event as an example:\r\n\r\nIn OSSEC alerts.json:\r\n<snip>\r\n{\"rule\":{\"level\":2,\"comment\":\"Windows - AppLocker allowed program to run.\",\"sidid\":18302,\"firedtimes\":13,\"groups\":[\"windows\",\"applocker\"],\"PCI_DSS\":[\"10.2.2\",\"10.6.1\"]},\"dstuser\":\"GJahchan\",\"full_log\":\"2016 Sep 14 10:44:43 WinEvtLog: Microsoft-Windows-AppLocker/EXE and DLL: INFORMATION(8002): Microsoft-Windows-AppLocker: GJahchan: DESKTOP: Desktop: %SYSTEM32%\\\\NSLOOKUP.EXE was allowed to run.\",\"id\":\"8002\",\"status\":\"INFORMATION\",\"data\":\"Microsoft-Windows-AppLocker\",\"systemname\":\"Desktop\",\"decoder\":{\"name\":\"windows\"},\"hostname\":\"Win10EntDsktp\",\"agentip\":\"192.168.16.1\",\"timestamp\":\"2016 Sep 14 10:44:56\",\"location\":\"WinEvtLog\"}\r\n<snip>\r\n\r\nIn Elasticsearch: (OSSEC alerts.json --> filebeat --> logstash --> elasticsearch)\r\n{\r\n  \"_index\": \"ossec-2016.09.14\",\r\n  \"_type\": \"ossec\",\r\n  \"_id\": \"AVcnqBakhBmn8wp-jU8U\",\r\n  \"_score\": null,\r\n  \"_source\": {\r\n    \"rule\": {\r\n      \"sidid\": 18302,\r\n      \"firedtimes\": 13,\r\n      \"groups\": [\r\n        \"windows\",\r\n        \"applocker\"\r\n      ],\r\n      \"PCI_DSS\": [\r\n        \"10.2.2\",\r\n        \"10.6.1\"\r\n      ],\r\n      \"description\": \"Windows - AppLocker allowed program to run.\",\r\n      \"AlertLevel\": 2\r\n    },\r\n    \"dstuser\": \"GJahchan\",\r\n    \"full_log\": \"2016 Sep 14 10:44:43 WinEvtLog: Microsoft-Windows-AppLocker/EXE and DLL: INFORMATION(8002): Microsoft-Windows-AppLocker: GJahchan: DESKTOP: Desktop: %SYSTEM32%\\\\NSLOOKUP.EXE was allowed to run.\",\r\n    \"id\": \"8002\",\r\n    \"status\": \"INFORMATION\",\r\n    \"data\": \"Microsoft-Windows-AppLocker\",\r\n    \"systemname\": \"Desktop\",\r\n    \"decoder\": {\r\n      \"name\": \"windows\"\r\n    },\r\n    \"location\": \"WinEvtLog\",\r\n    \"@version\": \"1\",\r\n    \"@timestamp\": \"2016-09-14T07:44:56.000Z\",\r\n    \"fields\": null,\r\n    \"offset\": 1937063,\r\n    \"count\": 1,\r\n    \"input_type\": \"log\",\r\n    \"beat\": {\r\n      \"hostname\": \"capricorn\",\r\n      \"name\": \"capricorn\"\r\n    },\r\n    \"source\": \"/var/ossec/logs/alerts/alerts.json\",\r\n    \"type\": \"log\",\r\n    \"host\": \"capricorn\",\r\n    \"tags\": [\r\n      \"ossec\",\r\n      \"beats_input_codec_json_applied\"\r\n    ],\r\n    \"AgentName\": \"Win10EntDsktp\",\r\n    \"AgentIP\": \"192.168.16.1\",\r\n    \"machine\": \"false\"\r\n  },\r\n  \"fields\": {\r\n    \"@timestamp\": [\r\n      1473839096000\r\n    ]\r\n  },\r\n  \"highlight\": {\r\n    \"AgentName\": [\r\n      \"@kibana-highlighted-field@Win10EntDsktp@/kibana-highlighted-field@\"\r\n    ]\r\n  },\r\n  \"sort\": [\r\n    1473839096000\r\n  ]\r\n}\r\n\r\nIn Graylog2: (OSSEC alerts.json --> OSSEC csyslogd --> Graylog CEF UDP Plugin --> Graylog\r\nZero Applocker events.\r\n\r\nI can confirm that OSSEC csyslogd is indeed forwarding AppLocker events by dumping traffic to udp port 2514:\r\n\r\n$ sudo tcpdump -i lo -vvv -nn -p -A udp and port 2514\r\n<snip>\r\n11:11:10.500410 IP (tos 0x0, ttl 64, id 56708, offset 0, flags [DF], proto UDP (17), length 507)\r\n    127.0.0.1.59218 > 127.0.0.1.2514: [bad udp cksum 0xfffa -> 0xc1dc!] UDP, length 479\r\nE.....@.@.]k.........R  .....<132>Sep 14 11:11:09 CEF:0|Trend Micro Inc.|OSSEC HIDS|v2.8|18302|Windows - AppLocker allowed program to run.|2|dvc=capricorn cs2=(Win10EntDsktp) 192.168.16.1->WinEvtLog cs2Label=Location classification= windows,applocker,pci_dss_10.2.2,pci_dss_10.6.1, suser=GJahchan suser=GJahchan msg=2016 Sep 14 11:10:56 WinEvtLog: Microsoft-Windows-AppLocker/EXE and DLL: INFORMATION(8002): Microsoft-Windows-AppLocker: GJahchan: DESKTOP: Desktop: %SYSTEM32%\\NSLOOKUP.EXE was allowed to run.\r\n<snip>\r\n\r\n<!--- reproduce this bug. Include code to reproduce, if relevant -->\r\n1. Activate AppLocker in Audit mode on Windows system with OSSEC Agent installed.\r\n2. Configure agent to collect the AppLocker logs (in /var/ossec/etc/shared/agent.conf on OSSEC server):\r\n<agent_config name=\"AgentName\">\r\n  <localfile>\r\n    <log_format>eventchannel</log_format>\r\n    <location>Microsoft-Windows-AppLocker/EXE and DLL</location>\r\n  </localfile>\r\n  <localfile>\r\n    <log_format>eventchannel</log_format>\r\n    <location>Microsoft-Windows-AppLocker/MSI and Script</location>\r\n  </localfile>\r\n  <localfile>\r\n    <log_format>eventchannel</log_format>\r\n    <location>Microsoft-Windows-AppLocker/Packaged app-Deployment</location>\r\n  </localfile>\r\n  <localfile>\r\n    <log_format>eventchannel</log_format>\r\n    <location>Microsoft-Windows-AppLocker/Packaged app-execution</location>\r\n  </localfile>\r\n</agent_config>\r\n\r\n3. Add the following AppLocker-specific rules to /var/ossec/rules/local_rules.xml:\r\n...\r\n<!-- Windows AppLocker Rules - G Jahchan 2016-08-28 10:00 EET -->\r\n<group name=\"windows,applocker,\">\r\n  <!-- Ref: https://technet.microsoft.com/en-us/library/ee844150(v=ws.10).aspx -->\r\n  <rule id=\"18300\" level=\"2\">\r\n    <if_sid>18103</if_sid>\r\n    <id>^8000$</id>\r\n    <description>Windows - Application Identity Policy conversion failed.</description>\r\n    <group>pci_dss_10.6.1,</group>\r\n  </rule>\r\n\r\n  <rule id=\"18301\" level=\"2\">\r\n    <if_sid>18101</if_sid>\r\n    <id>^8001$</id>\r\n    <description>Windows - AppLocker policy was applied successfully to this computer.</description>\r\n    <group>pci_dss_10.6.1,</group>\r\n  </rule>\r\n\r\n  <rule id=\"18302\" level=\"2\">\r\n    <if_sid>18101</if_sid>\r\n    <id>^8002$</id>\r\n    <description>Windows - AppLocker allowed program to run.</description>\r\n    <group>pci_dss_10.2.2,pci_dss_10.6.1,</group>\r\n  </rule>\r\n\r\n  <rule id=\"18303\" level=\"2\">\r\n    <if_sid>18102</if_sid>\r\n    <id>^8003$</id>\r\n    <description>Windows - AppLocker allowed program to run in audit mode.</description>\r\n    <group>pci_dss_10.2.2,pci_dss_10.6.1,</group>\r\n  </rule>\r\n\r\n  <rule id=\"18304\" level=\"12\">\r\n    <if_sid>18103</if_sid>\r\n    <id>^8004$</id>\r\n    <description>Windows - AppLocker blocked program.</description>\r\n    <group>pci_dss_10.6.1,</group>\r\n  </rule>\r\n\r\n  <rule id=\"18305\" level=\"2\">\r\n    <if_sid>18101</if_sid>\r\n    <id>^8005$</id>\r\n    <description>Windows - AppLocker allowed an MSI or script to run.</description>\r\n    <group>pci_dss_10.2.2,pci_dss_10.6.1,</group>\r\n</rule>\r\n\r\n  <rule id=\"18306\" level=\"2\">\r\n    <if_sid>18102</if_sid>\r\n    <id>^8006$</id>\r\n    <description>Windows - AppLocker allowed an MSI or script to run in audit mode.</description>\r\n    <group>pci_dss_10.2.2,pci_dss_10.6.1,</group>\r\n  </rule>\r\n\r\n  <rule id=\"18307\" level=\"12\">\r\n    <if_sid>18103</if_sid>\r\n    <id>^8007$</id>\r\n    <description>Windows - AppLocker prevented an MSI or script to run.</description>\r\n    <group>pci_dss_10.6.1,</group>\r\n  </rule>\r\n\r\n  <rule id=\"18308\" level=\"2\">\r\n    <if_sid>18101</if_sid>\r\n    <id>^8020$</id>\r\n    <description>Windows - Packaged app allowed.</description>\r\n    <group>pci_dss_10.2.2,pci_dss_10.6.1,</group>\r\n  </rule>\r\n\r\n  <rule id=\"18309\" level=\"2\">\r\n    <if_sid>18101</if_sid>\r\n    <id>^8021$</id>\r\n    <description>Windows - Packaged app audited.</description>\r\n    <group>pci_dss_10.2.2,pci_dss_10.6.1,</group>\r\n  </rule>\r\n\r\n  <rule id=\"18310\" level=\"12\">\r\n    <if_sid>18101</if_sid>\r\n    <id>^8022$</id>\r\n    <description>Windows - Packaged app disabled.</description>\r\n    <group>pci_dss_10.6.1,</group>\r\n  </rule>\r\n\r\n  <rule id=\"18311\" level=\"2\">\r\n    <if_sid>18101$</if_sid>\r\n    <id>^8023$</id>\r\n    <description>Windows - Packaged app installation allowed.</description>\r\n    <group>pci_dss_10.2.2,pci_dss_10.6.1,</group>\r\n  </rule>\r\n\r\n  <rule id=\"18312\" level=\"2\">\r\n    <if_sid>18101</if_sid>\r\n    <id>^8024$</id>\r\n    <description>Windows - Packaged app installation audited.</description>\r\n    <group>pci_dss_10.2.2,pci_dss_10.6.1,</group>\r\n  </rule>\r\n\r\n  <rule id=\"18313\" level=\"12\">\r\n    <if_sid>18102</if_sid>\r\n    <id>^8025$</id>\r\n    <description>Windows - Packaged app installation disabled.</description>\r\n    <group>pci_dss_10.6.1,</group>\r\n  </rule>\r\n\r\n  <rule id=\"18314\" level=\"12\">\r\n    <if_sid>18102</if_sid>\r\n    <id>^8027$</id>\r\n    <description>Windows - No packaged app rule configured.</description>\r\n    <group>pci_dss_10.2.2,pci_dss_10.6.1,</group>\r\n  </rule>\r\n\r\n</group>\r\n4. Restart OSSEC agent and OSSEC server: \r\n    $ sudo /var/ossec/bin/ossec-control restart\r\n    $ sudo /var/ossec/bin/agent _control -R <agent_id>\r\n\r\n5. Install the CEF Syslog Plugin in Graylog2.\r\n\r\n6. Configure the CEF UDP plugin on a specific port (2514 in my case).\r\n\r\n7. Activate csyslogd in OSSEC and configure it to forward CEF format events to listener on UDP/2514.\r\n<ossec_config>\r\n  <snip>\r\n  <syslog_output>\r\n    <server>127.0.0.1</server>\r\n    <port>2514</port>\r\n    <format>cef</format>\r\n  </syslog_output>\r\n  <snip>\r\n</ossec_config>\r\n\r\n## Context\r\n<!--- How has this issue affected you? What are you trying to accomplish? -->\r\nThis is a pilot for a PCI-regulated environment. In the target environment, the inability to bring in event logs other the standard Windows logs precludes the use of Graylog2, which (along with elasticsearch in SIEMonster) otherwise fulfills the majority of organizational security event and information management needs.\r\n\r\n<!--- Providing context helps us come up with a solution that is most useful in the real world -->\r\n\r\n## Your Environment\r\n<!--- Include as many relevant details about the environment you experienced the bug in -->\r\n\r\n* Graylog Version: 2.0.0-rc1.1\r\n* Elasticsearch Version: 2.2.0\r\n* MongoDB Version: 3.5.3-1\r\n* Operating System: debian jessie/sid\r\n* Browser version: Google Chrome v53.0.2785.101 m (64-bit) on Windows 10\r\n\r\n(The machine is a SIEMonster Capricorn that is up-to-date as of the time of this posting).\r\n"},"comment":{"url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/comments/247949261","html_url":"https://github.com/Graylog2/graylog2-server/issues/2825#issuecomment-247949261","issue_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2825","id":247949261,"user":{"login":"jalogisch","id":404238,"avatar_url":"https://avatars.githubusercontent.com/u/404238?v=3","gravatar_id":"","url":"https://api.github.com/users/jalogisch","html_url":"https://github.com/jalogisch","followers_url":"https://api.github.com/users/jalogisch/followers","following_url":"https://api.github.com/users/jalogisch/following{/other_user}","gists_url":"https://api.github.com/users/jalogisch/gists{/gist_id}","starred_url":"https://api.github.com/users/jalogisch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jalogisch/subscriptions","organizations_url":"https://api.github.com/users/jalogisch/orgs","repos_url":"https://api.github.com/users/jalogisch/repos","events_url":"https://api.github.com/users/jalogisch/events{/privacy}","received_events_url":"https://api.github.com/users/jalogisch/received_events","type":"User","site_admin":false},"created_at":"2016-09-19T09:36:56Z","updated_at":"2016-09-19T09:36:56Z","body":"This issue was moved to Graylog2/graylog-plugin-cef#10"}}
{"actor":{"display_login":"jalogisch"}}