Unable to get windows audit log

[Aman]

Hi Team,

We are unable to get the events as well as email alerts for windows audit logs.

for example alert like schedule task is created (event ID 4698).

Regards,

Aman

[Ifeanyi Onyia Odike]

Hi Aman,

Thank you for using Wazuh!

I'm not sure what the challenge is. Can you include more details as to what the challenge is so we can provide assistance?

Regards,

[Aman]

Hi Ifeanyi,

I tried to add the below rule inside local_rules.xml but I am unable to get any event related to this in the wazuh dashboard.

<group name="windows,">
<rule id="100052" level="5">
<if_sid>60112</if_sid>
<field name="win.system.providerName">Microsoft-Windows-Security-Auditing</field>
<field name="win.system.eventID">4698</field>
<description>A scheduled task was created</description>
</rule>
</group>

Regards

[Ifeanyi Onyia Odike]

Hi Aman,

Please send the event log you would like to get an alert for.

[Aman]

Hi Ifeanyi,

I am unable to get the event as well.

Regards,

[Ifeanyi Onyia Odike]

Can you retrieve the event using the archival logall configuration?

Wazuh Logall