Application Whitelisting not working as expected

[DIWAHAR RAHAWID]

Hi Team,. 

I have configured application whitelisting as per the document https://github.com/juaromu/wazuh-windows-software-policy but recently come of the allowed application are killed by wazuh.

like: Microsoft Corporation

Amazon.com Inc.
Amazon Web Services, Inc.

Above vendors are allowed but been blocked 

Below are the application allowed. 

Microsoft Corporation:
Sysinternals - www.sysinternals.com:
Sysinternals:
Adobe Inc:
Wazuh Inc.:
Adobe Systems Incorporated:
ProPhoenix:
Gurock Software GmbH:
SmartSafety Software, Inc.:
Microsoft:
Amazon.com Inc.:
Kinetic Jump Software, LLC:
Amazon Web Services:
Duo Security:
Amazon Web Services, LLC:
Amazon Inc.:
Bitvise Limited:
CrowdStrike, Inc.:
Action1 Corporation:
Microsoft Corp.:
Wireshark development team:
Martin Prikryl:
Pnx.Phoenix.JobSvc:
Bitvise:
Amazon Web Services, Inc.:
Pnx.AI.Svc:
"The Wireshark developer community, https://www.wireshark.org/":

not sure why it is not working as it should. 

regards

Diwahar

[Darío Ortega Leyva]

Hi Diwahar,

The GitHub repository you followed is community content. It is not part of the official Wazuh documentation, it is not maintained by Wazuh, and its configuration snippets are not validated against current releases.

First, since legitimate processes are being terminated on production endpoints, I would disable the active-response block and run in detection mode only until this is resolved. The guide itself carries that warning.

Then three checks against the official documentation should tell you where the problem actually is:

1. On an affected Windows agent, open active-responses.log (typically C:\Program Files (x86)\ossec-agent\active-response\) and note the rule id in the alert JSON that was passed to the script. Then compare your active-response block against how level, rules_group and rules_id are documented to interact:
https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/active-response.html

2. Confirm the list compiled. ls -l /var/ossec/etc/lists/ should show software-vendors alongside a current software-vendors.cdb. Format requirements, including how to write keys that contain a colon, are here:
https://documentation.wazuh.com/current/user-manual/ruleset/cdb-list.html

3. Replay the original Sysmon event for one of the killed processes and check whether rule 100500 actually fires:
https://documentation.wazuh.com/current/user-manual/reference/tools/wazuh-logtest.html

Send back the rule id from step 1 and the result of step 3, and we can take it from there.

Regards