CDB list path

[German DiCasas]

Hi team,

I want to add a cdb list with a path of windows but give me error 

somethig like C:\ProgramData\Adobe\program.exe over key or "C:\ProgramData\Adobe\program1.exe" give me the error of:

"Must not contain simbols when using quotes(only letters, numbers and colon)"

How can I make that? I want to check if the alert have a special path.

I have wazuh 14.4.1 all inone server

Thanks

German

[hasitha.u...@wazuh.com]

Hi German

Please allow me some time; I’m currently looking into this and will get back to you with an update as soon as possible.

[hasitha.u...@wazuh.com]

Hi German,

I tested this on my side and experienced the same issue. To resolve it, follow the steps below.

Navigate to your CDB list file:

nano /var/ossec/etc/lists/<yourlistname>

Then add the entries in the following format:

"C:\ProgramData\Adobe\program.exe":allowed
"C:\ProgramData\Adobe\program1.exe":allowed

Save the file and exit.

After that, restart the Wazuh manager to apply the changes:

systemctl restart wazuh-manager

Then test again and verify whether the rule matches correctly.

Let me know how it goes.

Ref: https://documentation.wazuh.com/current/user-manual/ruleset/cdb-list.html