How to collect Windows logs

Available channels and providers

Table below shows available channels and providers to monitor included in the Wazuh ruleset:

When monitoring a channel, events from different providers can be gathered. At the ruleset this is taken into account to monitor logs from McAfee, Eventlog or Security Essentials.

Windows ruleset redesign

In order to ease the addition of new rules, the eventchannel ruleset has been classified according to the channel from which events belong. This will ensure an easier way of maintaining the ruleset organized and find the better place for custom rules. To accomplish this, several modifications have been added:

• Each eventchannel file contains a specific channel's rules.

• A base file includes every parent rule filtering by the specific channels monitored.

• Rules have been updated and improved to match the new JSON events, showing relevant information at the rule's description and facilitating the way of filtering them.

• New channel's rules have been added. By default, the monitored channels are System, Security and Application, these channels have their own file now and include a fair set of rules.

• Every file has their own rule ID range in order to get it organized. There are a hundred IDs set for the base rules and five hundred for each channel file.

• In case some rules can't be classified easily or there are so few belonging to a specific channel, they are included at a generic Windows rule file.

To have a complete view of which events are equivalent to the old ones from eventlog and the previous version of eventchannel, this table classifies every rule according to the source in which they were recorded, including their range of rule IDs and the file where they are described.

Eventchannel for Wazuh >= 3.9.0

Eventchannel and eventlog for Wazuh < 3.9.0

Use case

This section describes a simple use case of an alert triggered when an installation event occurs.

The installation log will be collected at the Application channel. To monitor logs generated by this source with the eventchannel format, the configuration file should include the next localfile block:

<localfile>
  <location>Application</location>
  <log_format>eventchannel</log_format>
</localfile>

The next step is to install a new application. Once it is installed, the Wazuh manager will build the next JSON event related with the installation process:

{
    "win": {
        "system": {
        "providerName": "MsiInstaller",
        "eventID": "11707",
        "level": "4",
        "task": "0",
        "keywords": "0x80000000000000",
        "systemTime": "2019-04-03T10:47:39.000000000Z",
        "eventRecordID": "12615",
        "channel": "Application",
        "computer": "pcname",
        "severityValue": "INFORMATION",
        "message": "Product: Dr. Memory -- Installation completed successfully."
        },
        "eventdata": {
        "binary": "7B36373637354144362D314642302D344445312D394543462D3834393937353135303235457D",
        "data": "Product: Dr. Memory -- Installation completed successfully."
        }
    }
}

This event can be filtered field by field in case an alert is desired to trigger when it occurs. In this use case, the filters used will be the provider name and the event ID, as follows:

<rule id="60612" level="3">
    <field name="win.system.providerName">MsiInstaller</field>
    <field name="win.system.eventID">^11707$|^1033$</field>
    <options>alert_by_email</options>
    <description>Application Installed $(win.eventdata.data)</description>
    <options>no_full_log</options>
</rule>

Finally, once the event is generated, the rule from above will be matched and therefore, trigger the next alert shown at the Kibana app:

The next images show a simple event collection with the eventchannel log format. The first one represents the number of events of each channel, filtered by provider name along the time.

Some events from different channels are shown below with the associated provider name and severity value:

Filtering events from Windows Event Channel with queries

Events from the Windows Event channel can be filtered as below. In this example, only events which levels are less or equal to "3" are checked.

<localfile>
  <location>System</location>
  <log_format>eventchannel</log_format>
  <query>Event/System[EventID=7040]</query>
</localfile>

Users can filter events with different severity levels.

<localfile>
    <location>System</location>
    <log_format>eventchannel</log_format>
    <query>
        \<QueryList>
            \<Query Id="0" Path="System">
                \<Select Path="System">*[System[(Level&lt;=3)]]\</Select>
            \</Query>
        \</QueryList>
    </query>
</localfile>