Error: Field 'system_name' is static

[Tewodros Ambasa]

 Hello. I am experiencing an issue when using the system_name field in my rule, which has been extracted from an event via the below decoder:

**Phase 2: Completed decoding.
       decoder: 'windows'
       type: 'Security'
       status: 'AUDIT_SUCCESS'
       id: '4738'
       extra_data: 'Microsoft-Windows-Security-Auditing'
       dstuser: '(no user)'
       system_name: 'COMPUTER_NAME.DOMAIN'
       subject.security_id: 'S-1-5-18'
       subject.account_name: 'COMPUTER_NAME$'
       subject.account_domain: 'DOMAIN'
       subject.logon_id: '0x3E7'
       security_id: 'S-1-5-21-3755148764-1148274065-1054956982-1003'
       account_name: 'USERNAME'
       account_domain: 'COMPUTER_NAME'

Below is my rule:

<rule id="100050" level="0">
    <if_sid>18111</if_sid>
    <field name="system_name">COMPUTER_NAME.DOMAIN</field>
    <field name="subject.account_name">COMPUTER_NAME\$</field>
    <field name="account_name">USERNAME</field>
    <description>Ignore Windows Security Log Event ID 4738</description>
  </rule>

When running:

so-ossec-restart && tail /var/ossec/logs/ossec.log

I get the below error:

ERROR: Field 'system_name' is static.

However if I replace the third line of my rule with:

<system_name>COMPUTER_NAME.DOMAIN</system_name>

I now get the below error:

ERROR: Invalid option 'system_name' for rule '100050'.

What could the problem be?

[Alberto Marín]

Hi Tewodros,

the issue you reported is a bug caused by the rules parsing function. The `system_name` fields is not being parsed correctly.
I've opened this issue https://github.com/wazuh/wazuh/issues/3407 which be solved in a future release.

Sorry for the inconvenience.

Best regards.