eventchannel log format WINDOWS

[Adiel Jesus Navarro Rosado]

How can I received eventchannel log format from WINDOWS?

 

I tried to monitoring the next location at a Windows 7

 

<localfile>

    <location>Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational</location>

    <log_format>eventchannel</log_format>

  </localfile>

 

In my OSSEC SERVER local_rules.xml I have these entries:

 

<rule id="100888" level="11">

<if_sid>18104</if_sid>

<id>^682|^4778|^1149</id>

<description>Remote Desktop Connection Established</description>

<group>sysadmin,</group>

</rule>

 

<rule id="100999" level="11">

<if_sid>18104</if_sid>

<id>^683|^4779</id>

<description>Remote Desktop Connection Disconnected</description>

<group>sysadmin,</group>

</rule>

 

 

 

But only receive Event Viewer logs…

 

 

 

[Victor Fernandez]

Hi,

when you use Event Channel, you should use a specific query, such:

<localfile>

  <location>Security</location>

  <log_format>eventchannel</log_format>

  <query>Event/System[EventID != 5145 and EventID != 5156 and EventID != 5447]</query>

</localfile>

You may read this page for more information: https://documentation.wazuh.com/current/user-manual/capabilities/log-data-collection/log-data-configuration.html?highlight=eventchannel#filtering-events-from-windows-event-channel-with-queries

Best regards.

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
To post to this group, send email to wa...@googlegroups.com.
Visit this group at https://groups.google.com/group/wazuh.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/36f940545e5f465fbe18a59388234994%40RLEXTL04.amx.net.
For more options, visit https://groups.google.com/d/optout.

--

Victor M. Fernandez-Castro

IT Security Engineer

Wazuh Inc.