Not working correlation rule with argument frequency and timeframe

[WiFi]

Good afternoon, dear colleagues! I would like to write a correlation rule, according to which, when a person incorrectly logs into a Windows session at least 3 times in a certain period of time, an alert appears. However, this does not happen when adding the frequency and timeframe variables. I have attached an example of the rule. Wazuh version 4.9.2 , please tell me my mistake. I tried to log into windows 3 times. However, he gave me all 3 of my attempts, and I need him to give me one attempt at 3 times.

[Stuti Gupta]

Hi  Devsecof

The default rule 60122 is :

  <rule id="60122" level="5">
    <if_sid>60105</if_sid>
    <field name="win.system.eventID">^529$|^4625$</field>
    <description>Logon Failure - Unknown user or bad password</description>
    <options>no_full_log</options>
    <group>win_authentication_failed,pci_dss_10.2.4,pci_dss_10.2.5,gpg13_7.1,gdpr_IV_35.7.d,gdpr_IV_32.2,hipaa_164.312.b,nist_800_53_AU.14,nist_800_53_AC.7,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,</group>
  </rule>

However, when you overwrite the rule, you have replaced the if_sid with of_matched_sid.To maintain consistency across loaded rules, it is currently not possible to overwrite the if_sid, if_group, if_level, if_matched_sid, and if_matched_group labels. These tags are ignored when present in an overwrite rule, preserving the original values.
So instead of overwriting the rule, I will suggest to add a custom rule at /var/ossec/etc/rules/local_rules.xml

<rule id="1060122" level="3" frequency="3" timeframe="30">
    <if_matched_sid>60105</if_matched_sid>
    <field name="win.system.eventID">^529$|^4625$</field>
    <description>Logon Failure - Unknown user or bad password</description>
    <options>no_full_log</options>
    <group>win_authentication_failed,pci_dss_10.2.4,pci_dss_10.2.5,gpg13_7.1,gdpr_IV_35.7.d,gdpr_IV_32.2,hipaa_164.312.b,nist_800_53_AU.14,nist_800_53_AC.7,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,</group>
  </rule>

To know more about the custom rules please refer to https://documentation.wazuh.com/current/user-manual/ruleset/rules/custom.html

Let me know if you need any further assistance!

[WiFi]

Thanks, but i have a problem...
If im copy your rule i have syntax error.
Im attached screen where im in local_rules

Text error:
Error: Could not upload rule (1113) - XML syntax error at WzRequest.returnErrorInstance (https://10.0.220.39/49201/bundles/plugin/wazuh/wazuh.plugin.js:1:250522) at WzRequest.apiReq (https://10.0.220.39/49201/bundles/plugin/wazuh/wazuh.plugin.js:1:249664) at async resources_handler_ResourcesHandler.updateFile (https://10.0.220.39/49201/bundles/plugin/wazuh/wazuh.chunk.3.js:1:2367836) at async file_editor_WzFileEditor.save (https://10.0.220.39/49201/bundles/plugin/wazuh/wazuh.chunk.3.js:1:2437333)

вторник, 4 марта 2025 г. в 13:34:39 UTC+3, Stuti Gupta:

[Stuti Gupta]

Hi Devsecof,

Can you share your file in text format so I can review it and let you know why you're facing this error?

Looking forward to your response