User Information Not Fetching by Wazuh Alerts

[Prajapati Hitesh]

Hi,

I am not getting user name if any software installed or uninstalled on sever. I am getting alert on email but user name not display. Below alert email is for your reference.  Also, i have attached my server log snip in which user name display.

undefined

@timestamp

Jan 31, 2023 @ 15:24:24.072

agent.id

722

agent.ip

10.1.1.122

agent.name

SQL162017

data.win.eventdata.binary

7B34303532353244432D414446372D344243382D393546352D4638394445353133444436327D

data.win.eventdata.data

Product: Microsoft SQL Server 2017 Setup (English) -- Removal completed successfully.

data.win.system.channel

Application

data.win.system.computer

SQL162017.test.net

data.win.system.eventID

11724

data.win.system.eventRecordID

51969

data.win.system.keywords

0x80000000000000

data.win.system.level

4

data.win.system.message

"Product: Microsoft SQL Server 2017 Setup (English) -- Removal completed successfully."

data.win.system.providerName

MsiInstaller

data.win.system.severityValue

INFORMATION

data.win.system.systemTime

2023-01-31T09:54:24.000000000Z

data.win.system.task

0

decoder.name

windows_eventchannel

id

1675158864.1294764985

input.type

log

location

EventChannel

manager.name

wazuh01

rule.description

Application Uninstalled Product: Microsoft SQL Server 2017 Setup (English) -- Removal completed successfully.

rule.firedtimes

121

rule.groups

local, syslog, sshd

rule.id

60611

rule.level

11

rule.mail

true

timestamp

Jan 31, 2023 @ 15:24:24.072

[Carlos Dams]

Hi Prajapati,

Thanks for using Wazuh!

This information is not brought to Wazuh with that specific event ID, there is an issue created to address that bug: https://github.com/wazuh/wazuh/issues/4439 

In the meantime, to find that same event quickly on the Windows host where the application was installed or uninstalled you can copy the data.win.eventdata.binary value from the event that you see in Wazuh Dashboard, go to the Application channel of the Event viewer, under Actions on the right side click on "Find…" and enter the information copied, you will be able to locate quickly the events associated with the data.win.eventdata.binary

I hope you find this information useful.

[Prajapati Hitesh]

Hi Carlos,

Yes, I am able to search event on server as you mentioned. Please help how can i resolve user id not found in wazuh mail alert because in your reference link i am not able to found  winevtchannel.c  in my wazuh server. 

[Carlos Dams]

Hi Prajapati,

The winevtchannel.c is the decoder used by Wazuh manager for events coming from the Windows event channels, it is integrated in the source code of decoders in Wazuh so you won't be able to edit it as a normal file on the backend.

[Prajapati Hitesh]

So, can you guide me how to resolve this issue?