Filter group agentes Event ID not working

[Facu Basgall]

Hello. I’m trying to set up a filter for a group of agents.

It’s as follows:

<localfile>
<location>Security</location>
<log_format>eventchannel</log_format>
<query>
\<QueryList>
\<Query Id="0" Path="Microsoft-Windows-Security-Auditing">
\<Select Path="Microsoft-Windows-Security-Auditing">
*[System[(EventID=4674)]
and
(EventData/Data[@Name='SubjectUserName'] != 'sqlservicios')
and
(EventData/Data[@Name='PrivilegeList'] != 'SeBackupPrivilege')
and
(EventData/Data[@Name='ProcessName'] != 'D:\\Program Files\\Microsoft SQL Server\\150\\DTS\\Binn\\DTExec.exe')]
\</Select>
\</Query>
\</QueryList>
</query>
</localfile>   

But it’s not working as expected, because when I apply it, I stop receiving all events from the Security channel.

Can you help me? 

[Ezequiel Montero]

Greetings Facu,

The issue is the `Path` attribute in your <Query> and <Select> elements. It must reference the event log **channel** ("Security"), not the event **source/provider** ("Microsoft-Windows-Security-Auditing"). Since that channel doesn't exist, Windows rejects the whole subscription, which is why you stop receiving any events from Security at all — see the structured query examples in the docs, they always use the channel name (e.g. Path="System"):
https://documentation.wazuh.com/current/user-manual/capabilities/log-data-collection/configuration.html
https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/localfile.html#query

Try this instead:

<localfile>
    <location>Security</location>
    <log_format>eventchannel</log_format>
    <query>
        \<QueryList>

        \<Query Id="0" Path="Security">
        \<Select Path="Security">
            *[System[(EventID=4674)]
            and
            not(EventData/Data[@Name='SubjectUserName']='sqlservicios')
            and
            not(EventData/Data[@Name='PrivilegeList']='SeBackupPrivilege')
            and
            not(EventData/Data[@Name='ProcessName']='D:\\Program Files\\Microsoft SQL Server\\150\\DTS\\Binn\\DTExec.exe')]

        \</Select>
        \</Query>
        \</QueryList>
    </query>
</localfile>

I also swapped the `!=` comparisons for `not(... = ...)` — the Windows Event Log XPath engine handles negation more reliably that way when comparing against EventData/Data nodes.

Before rolling this out via the agent, it's worth pasting just the XPath expression (without the QueryList wrapper) into Event Viewer's "Filter Current Log > XML tab > Edit query manually" on that machine — if Windows accepts it there, it'll work in Wazuh too, and it isolates whether a future issue is on the Windows side or the agent config side.

Restart the agent after the change for it to take effect.

--
You received this message because you are subscribed to the Google Groups "Wazuh | Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/wazuh/7318d921-2c74-47cc-9d96-81f30cdba02cn%40googlegroups.com.