Application logs decoding in windows

[TUKARAM GAONKAR]

Dear Team ,

I found my Antivirus sending logs through the " windows_eventchannel " decoder . I am trying to find a decoder in the " windows_decoder.xml " file.But i did not get it . Let us know which file decoder available for the following log. I want to edit that file to extract some fields .

{"win":{"system":{"providerName":"Symantec AntiVirus","eventID":"45","level":"4","task":"0","keywords":"0x80000000000000","systemTime":"2021-06-16T14:42:24.000000000Z","eventRecordID":"510191","channel":"Application","computer”:”Xxx”,”severityValue":"INFORMATION","message":"\" \r\n\r\nScan type: Tamper Protection Scan\r\nEvent: Tamper Protection Detection\r\nSecurity risk detected: C:\\PROGRAM FILES\\TREND MICRO\\yyy\\CORESERVICESHELL.EXE\r\nFile: E:\\Program Files (x86)\\Sss\\Symantec Endpoint Protection Manager\\bin\\USNWash.exe\r\nLocation: R:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection Manager\\bin\r\nComputer: abcd\r\nUser: SYSTEM\r\nAction taken: Leave Alone\r\nDate found: Wednesday, June 16, 2021  8:12:24 PM\""},"eventdata":{"data":"    Scan type: Tamper Protection Scan  Event: Tamper Protection Detection  Security risk detected: C:\\\\PROGRAM FILES\\\\TREND MICRO\\\\sss\\\\CORESERVICESHELL.EXE  File: E:\\\\Program Files (x86)\\\\abc\\\\Symantec Endpoint Protection Manager\\\\bin\\\\USNWash.exe  Location: E:\\\\Program Files (x86)\\\\Symantec\\\\Symantec Endpoint Protection Manager\\\\bin  Computer: xxx  User: SYSTEM  Action taken: Leave Alone  Date found: Wednesday, June 16, 2021  8:12:24 PM"}}}

[Asunción Gómez Castro]

Hi!

The Windows Event Channel decoder in Wazuh is not declared in an XML file but embedded in the source code instead, so it is not that easy to modify. Usually, for a regular decoder, you could create a child decoder, but this possibility or windows_eventchannel is still under development. You can track this issue to see the progress:

https://github.com/wazuh/wazuh/issues/3193

In the meantime, as a workaround, you could write your rules by working with the information provided by the default decoder. I can assist you with that process if you need me to.