USB monitoring, regex not working.

[andrzej oto]

Hi
I want to monitor USB devices
I use these decoders

<decoder name="windows_fields">
  <type>windows</type>
  <parent>windows</parent>
  <regex>USBSTOR#Disk\pVen_(\S*)\pProd_(\S*)\pRev_(\.*)#(\S*)\p0#\S*\s</regex>
  <order>usb.vendor, usb.product, usb.rev, usb.serial_number</order>
</decoder>

I can see the event, but the regex doesn't work
I have read these articles
https://wazuh.com/blog/monitoring-usb-drives-in-windows-using-wazuh/
https://groups.google.com/g/wazuh/c/sFlNML0civk
https://groups.google.com/g/wazuh/c/sFXdMYgjYac


I created a rule

<rule id="100002" level="5">
  <if_sid>60103</if_sid>
  <field name="win.system.eventID">^6416$</field>
  <description>Windows: Authorized PNP device connected.</description>

</rule>
<rule id="100003" level="7">
  <if_sid>100002</if_sid>
  <list field="win.eventdata.deviceId" lookup="not_match_key">etc/lists/usb-devices</list>
  <description>Windows: Unauthorized PNP device connected.</description>
</rule>

but i need to modify my list of usb devices
and add everything

SWD\\WPDBUSENUM\\_??_USBSTOR#Disk&amp;Ven__USB&amp;Prod__SanDisk_3.2Gen1&amp;Rev_1.00#04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}:Andrzej_USB
STORAGE\\Volume\\_??_USBSTOR#Disk&amp;Ven__USB&amp;Prod__SanDisk_3.2Gen1&amp;Rev_1.00#04015a8bb9603e5aeb35e50824b8c53a38f847e56adb9976c247ca7b9dcc163#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}:Andrzej_USB

I think it's because of the regex problem, do you have an idea what could be causing this?

[Chantal Belen Kelm]

Hello, how are you? I will review the information you sent and make some checks.

[Chantal Belen Kelm]

can you share with me the log that arrives to the wazuh manager?

[andrzej oto]

Yes please,

--
You received this message because you are subscribed to a topic in the Google Groups "Wazuh mailing list" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/wazuh/EcyCshOnwKI/unsubscribe.
To unsubscribe from this group and all its topics, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/144f297d-9677-46cf-9b12-2e5d9e6e1e24n%40googlegroups.com.