{"action":"created","issue":{"url":"https://api.github.com/repos/wazuh/wazuh/issues/905","repository_url":"https://api.github.com/repos/wazuh/wazuh","labels_url":"https://api.github.com/repos/wazuh/wazuh/issues/905/labels{/name}","comments_url":"https://api.github.com/repos/wazuh/wazuh/issues/905/comments","events_url":"https://api.github.com/repos/wazuh/wazuh/issues/905/events","html_url":"https://github.com/wazuh/wazuh/issues/905","id":338942237,"node_id":"MDU6SXNzdWUzMzg5NDIyMzc=","number":905,"title":"Automatic decoders for Windows events","user":{"login":"vikman90","id":10536251,"node_id":"MDQ6VXNlcjEwNTM2MjUx","avatar_url":"https://avatars3.githubusercontent.com/u/10536251?v=4","gravatar_id":"","url":"https://api.github.com/users/vikman90","html_url":"https://github.com/vikman90","followers_url":"https://api.github.com/users/vikman90/followers","following_url":"https://api.github.com/users/vikman90/following{/other_user}","gists_url":"https://api.github.com/users/vikman90/gists{/gist_id}","starred_url":"https://api.github.com/users/vikman90/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vikman90/subscriptions","organizations_url":"https://api.github.com/users/vikman90/orgs","repos_url":"https://api.github.com/users/vikman90/repos","events_url":"https://api.github.com/users/vikman90/events{/privacy}","received_events_url":"https://api.github.com/users/vikman90/received_events","type":"User","site_admin":false},"labels":[{"id":246680126,"node_id":"MDU6TGFiZWwyNDY2ODAxMjY=","url":"https://api.github.com/repos/wazuh/wazuh/labels/enhancement","name":"enhancement","color":"0052cc","default":true},{"id":1052006459,"node_id":"MDU6TGFiZWwxMDUyMDA2NDU5","url":"https://api.github.com/repos/wazuh/wazuh/labels/logcollector","name":"logcollector","color":"b0ccf2","default":false}],"state":"open","locked":false,"assignee":{"login":"cristgl","id":14914658,"node_id":"MDQ6VXNlcjE0OTE0NjU4","avatar_url":"https://avatars2.githubusercontent.com/u/14914658?v=4","gravatar_id":"","url":"https://api.github.com/users/cristgl","html_url":"https://github.com/cristgl","followers_url":"https://api.github.com/users/cristgl/followers","following_url":"https://api.github.com/users/cristgl/following{/other_user}","gists_url":"https://api.github.com/users/cristgl/gists{/gist_id}","starred_url":"https://api.github.com/users/cristgl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cristgl/subscriptions","organizations_url":"https://api.github.com/users/cristgl/orgs","repos_url":"https://api.github.com/users/cristgl/repos","events_url":"https://api.github.com/users/cristgl/events{/privacy}","received_events_url":"https://api.github.com/users/cristgl/received_events","type":"User","site_admin":false},"assignees":[{"login":"cristgl","id":14914658,"node_id":"MDQ6VXNlcjE0OTE0NjU4","avatar_url":"https://avatars2.githubusercontent.com/u/14914658?v=4","gravatar_id":"","url":"https://api.github.com/users/cristgl","html_url":"https://github.com/cristgl","followers_url":"https://api.github.com/users/cristgl/followers","following_url":"https://api.github.com/users/cristgl/following{/other_user}","gists_url":"https://api.github.com/users/cristgl/gists{/gist_id}","starred_url":"https://api.github.com/users/cristgl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cristgl/subscriptions","organizations_url":"https://api.github.com/users/cristgl/orgs","repos_url":"https://api.github.com/users/cristgl/repos","events_url":"https://api.github.com/users/cristgl/events{/privacy}","received_events_url":"https://api.github.com/users/cristgl/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/wazuh/wazuh/milestones/4","html_url":"https://github.com/wazuh/wazuh/milestone/4","labels_url":"https://api.github.com/repos/wazuh/wazuh/milestones/4/labels","id":3856481,"node_id":"MDk6TWlsZXN0b25lMzg1NjQ4MQ==","number":4,"title":"49th week sprint","description":"2018/12/03 - 2018/12/07 / [Release 3.8.0 ](https://github.com/wazuh/wazuh/projects/20) ","creator":{"login":"vikman90","id":10536251,"node_id":"MDQ6VXNlcjEwNTM2MjUx","avatar_url":"https://avatars3.githubusercontent.com/u/10536251?v=4","gravatar_id":"","url":"https://api.github.com/users/vikman90","html_url":"https://github.com/vikman90","followers_url":"https://api.github.com/users/vikman90/followers","following_url":"https://api.github.com/users/vikman90/following{/other_user}","gists_url":"https://api.github.com/users/vikman90/gists{/gist_id}","starred_url":"https://api.github.com/users/vikman90/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vikman90/subscriptions","organizations_url":"https://api.github.com/users/vikman90/orgs","repos_url":"https://api.github.com/users/vikman90/repos","events_url":"https://api.github.com/users/vikman90/events{/privacy}","received_events_url":"https://api.github.com/users/vikman90/received_events","type":"User","site_admin":false},"open_issues":17,"closed_issues":9,"state":"open","created_at":"2018-11-28T22:50:46Z","updated_at":"2018-12-04T15:51:43Z","due_on":"2018-12-07T08:00:00Z","closed_at":null},"comments":13,"created_at":"2018-07-06T13:36:24Z","updated_at":"2018-12-05T07:32:51Z","closed_at":null,"author_association":"MEMBER","body":"Our windows decoders cause a lot of issues and they don't extract all the information. There are programs like NxLog (open source) or Winlogbeat (https://www.elastic.co/downloads/beats/winlogbeat) that convert from Windows log to JSON.\r\n\r\nWe have two options:\r\n\r\n- Send the raw log and parse the log to dynamic fields using plugin decoders.\r\n- Define a new logformat: `<logformat>windows_event</logformat>`. It sends the Windows event as JSON.\r\n\r\n```json\r\n{\r\n  \"EventTime\": \"2017-04-10 23:03:52\",\r\n  \"Hostname\": \"Desktop\",\r\n  \"Keywords\": -9214364837600035000,\r\n  \"EventType\": \"AUDIT_SUCCESS\",\r\n  \"SeverityValue\": 2,\r\n  \"Severity\": \"INFO\",\r\n  \"EventID\": 4688,\r\n  \"SourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n  \"ProviderGuid\": \"{54849625-5478-4994-A5BA-3E3B0328C30D}\",\r\n  \"Version\": 2,\r\n  \"Task\": 13312,\r\n  \"OpcodeValue\": 0,\r\n  \"RecordNumber\": 27093267,\r\n  \"ProcessID\": 4,\r\n  \"ThreadID\": 10112,\r\n  \"Channel\": \"Security\",\r\n  \"Message\": \"A new process has been created.\\r\\n\\r\\nCreator Subject:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-xxxx\\r\\n\\tAccount Name:\\t\\txxxxxx\\r\\n\\tAccount Domain:\\t\\tXXXXXXX\\r\\n\\tLogon ID:\\t\\t0x131E6806\\r\\n\\r\\nTarget Subject:\\r\\n\\tSecurity ID:\\t\\tS-1-0-0\\r\\n\\tAccount Name:\\t\\t-\\r\\n\\tAccount Domain:\\t\\t-\\r\\n\\tLogon ID:\\t\\t0x0\\r\\n\\r\\nProcess Information:\\r\\n\\tNew Process ID:\\t\\t0xe5c\\r\\n\\tNew Process Name:\\tC:\\\\Program Files (x86)\\\\Windows\\\\Resource Kits\\\\Tools\\\\tail.exe\\r\\n\\tToken Elevation Type:\\t%%1937\\r\\n\\tMandatory Label:\\t\\tS-1-16-12288\\r\\n\\tCreator Process ID:\\t0x91c\\r\\n\\tCreator Process Name:\\tC:\\\\Windows\\\\System32\\\\cmd.exe\\r\\n\\tProcess Command Line:\\ttail -1 win_sec_process_tracking.log\\r\\n\\r\\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\\r\\n\\r\\nType 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\\r\\n\\r\\nType 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\\r\\n\\r\\nType 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\",\r\n  \"Category\": \"Process Creation\",\r\n  \"Opcode\": \"Info\",\r\n  \"SubjectUserSid\": \"S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-xxxx\",\r\n  \"SubjectUserName\": \"xxxxxxxx\",\r\n  \"SubjectDomainName\": \"xxxxxxxx\",\r\n  \"SubjectLogonId\": \"0x131e6806\",\r\n  \"NewProcessId\": \"0xe5c\",\r\n  \"NewProcessName\": \"C:\\\\Program Files (x86)\\\\Windows\\\\Resource Kits\\\\Tools\\\\tail.exe\",\r\n  \"TokenElevationType\": \"%%1937\",\r\n  \"CommandLine\": \"tail -1 win_sec_process_tracking.log\",\r\n  \"TargetUserSid\": \"S-1-0-0\",\r\n  \"TargetUserName\": \"-\",\r\n  \"TargetDomainName\": \"-\",\r\n  \"TargetLogonId\": \"0x0\",\r\n  \"ParentProcessName\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\r\n  \"MandatoryLabel\": \"S-1-16-12288\",\r\n  \"EventReceivedTime\": 1491854633,\r\n  \"SourceModuleName\": \"win_sec_process_tracking\",\r\n  \"SourceModuleType\": \"im_msvistalog\"\r\n}\r\n```\r\n\r\n## Requirements\r\n\r\n- This new event format must be compatible with the same versions of Windows that the Eventchannel format supports.\r\n- This collector must extract all the possible data from the event.\r\n- The keys must be independent from the language of the operating system.\r\n\r\n## Subtasks\r\n\r\n- [x] Render the content of the Windows event log in XML.\r\n- [x] Extend the OSSEC XML parser to accept strings, in addition to files.\r\n- [x] Cut the `message` field in order to avoid duplicate data (already given in the XML content).\r\n- Test the new XML content:\r\n  - [x] It must work with every language of Windows.\r\n  - [x] The key data —name of the fields— must not change across languages.\r\n  - [x] The parser must extract all the possible fields.\r\n- [x] Compose the collected data into a JSON string.\r\n- [x] Test that the JSON parser correctly accepts the full event from the agent.\r\n- [x] Extend the ruleset to produce alerts.\r\n- [x] [Documentation](https://github.com/wazuh/wazuh-documentation/pull/660)\r\n- [x] Unify the start functions\r\n## Post conditions\r\n\r\n- The new alerts will have a different rule ID.\r\n\r\n## Testing\r\nSee the logs at archives.log and the alerts matched at alerts.log.\r\n\r\n- [x] Installing/uninstalling a program.\r\n- [x] Add, modify or remove a file at a FIM monitored folder.\r\n- [x] Sign out/sign in.\r\n- [x] Custom event (for example: eventcreate /T INFORMATION /ID 88 /L Application /SO MozillaFirefox /D \"Firefox has started successfully\".\r\n- [x] Installing chrome and seeing the logs generated at the archives.json file.\r\n- [x] Add a new user with Admin privileges or Child.\r\n\r\nWindows versions:\r\n- [x] Check all the Windows lower than Vista show the message that says that the eventchannel is not supported.\r\n- [x] Windows 7\r\n- [x] Windows 8.1\r\n- [x] Windows 10\r\n- [x] Windows Server 2019\r\n- [x] Test the newer versions of Windows in every language (english, spanish, french, chinese, japanese, russian, korean).\r\n- [ ] Test with a Wazuh app (https://github.com/wazuh/wazuh/issues/1997)."},"comment":{"url":"https://api.github.com/repos/wazuh/wazuh/issues/comments/444387066","html_url":"https://github.com/wazuh/wazuh/issues/905#issuecomment-444387066","issue_url":"https://api.github.com/repos/wazuh/wazuh/issues/905","id":444387066,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0NDM4NzA2Ng==","user":{"login":"cristgl","id":14914658,"node_id":"MDQ6VXNlcjE0OTE0NjU4","avatar_url":"https://avatars2.githubusercontent.com/u/14914658?v=4","gravatar_id":"","url":"https://api.github.com/users/cristgl","html_url":"https://github.com/cristgl","followers_url":"https://api.github.com/users/cristgl/followers","following_url":"https://api.github.com/users/cristgl/following{/other_user}","gists_url":"https://api.github.com/users/cristgl/gists{/gist_id}","starred_url":"https://api.github.com/users/cristgl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cristgl/subscriptions","organizations_url":"https://api.github.com/users/cristgl/orgs","repos_url":"https://api.github.com/users/cristgl/repos","events_url":"https://api.github.com/users/cristgl/events{/privacy}","received_events_url":"https://api.github.com/users/cristgl/received_events","type":"User","site_admin":false},"created_at":"2018-12-05T07:32:51Z","updated_at":"2018-12-05T07:32:51Z","author_association":"MEMBER","body":"Hello @V1D1AN,\r\n\r\nThis error comes when it is not possible to get the event message. Can you paste your ossec.conf here? Also I would like to know the Windows version and the language of it.\r\n\r\nBest regards"}}
{"actor":{"display_login":"cristgl"}}