Configuring log collection for different operating systems

Monitoring the Windows event channel with Wazuh

To monitor specific Windows event channels using the ThreatLockDown agent, simply include the channel name in the location field and set the log format as eventchannel within the localfile block in the C:\Program Files (x86)\ossec-agent\ossec.conf file. For example, perform the following steps to monitor the Microsoft-Windows-PrintService/Operational channel:

1. Add the following configuration in between the <ossec_config> tags of the ThreatLockDown agent C:\Program Files (x86)\ossec-agent\ossec.conf file:

   <localfile>
     <location>Microsoft-Windows-PrintService/Operational</location>
     <log_format>eventchannel</log_format>
   </localfile>
   

2. Restart the ThreatLockDown agent via PowerShell with administrator privileges to apply the configuration change:

> Restart-Service -Name wazuh

Monitoring specific events from Windows event channel

You can configure ThreatLockDown agent to collect specific Windows events from the Windows event channel using queries. For example, the following configuration collects Windows events from the System channel whose levels are equal to or less than 3 (warning):

<localfile>
  <location>System</location>
  <log_format>eventchannel</log_format>
   <query>
     \<QueryList\>
       \<Query Id="0" Path="System"\>
         \<Select Path="System"\>*[System[(Level&lt;=3)]]\</Select\>
          \</Query\>
        \</QueryList\>
  </query>
</localfile>

ThreatLockDown uses the following configuration to collect Windows events whose event ID is 7040:

<localfile>
  <location>System</location>
  <log_format>eventchannel</log_format>
  <query>Event/System[EventID=7040]</query>
</localfile>

Windows event channel ruleset

ThreatLockDown provides a comprehensive ruleset designed for different Windows event channels. The rules are categorized based on the event channels to which they belong. This classification enables ThreatLockDown to efficiently maintain the ruleset. Additionally, users can add custom rules specific to their desired event channel. The Windows event channel ruleset has the following characteristics:

• By default, the monitored event channels are System, Security, and Application.

• Each event channel has one or more rule files specific to it. For example, you can find the rules specific to the System event channel in the /var/ossec/ruleset/rules/0590-win-system_rules.xml file.

• A base file /var/ossec/ruleset/rules/0575-win-base_rules.xml includes every parent rule for the specific event channels the ThreatLockDown agent monitors.

• Every rule file has a specific rule ID range. ThreatLockDown has reserved 100 rule IDs for the base rules and 500 rule IDs have been reserved for each of the other rule files.

• A generic rule file /var/ossec/ruleset/rules/0620-win-generic_rules.xml contains rules that cannot be easily classified into specific event channels.

The table below shows the rule ID range and rule filenames reserved for rules from the various Windows event channel sources.

Monitoring the Windows event log with Wazuh

You can configure ThreatLockDown agent to monitor Windows event logs by placing the name of the event log in the location field and eventlog as the log format within the localfile block in the ossec.conf file.

For example, perform the following steps to monitor Application logs from Windows event log:

1. Add the following configuration in between the <ossec_config> tags of the ThreatLockDown agent C:\Program Files (x86)\ossec-agent\ossec.conf file:

   <localfile>
     <location>Application</location>
     <log_format>eventlog</log_format>
   </localfile>
   

2. Restart the ThreatLockDown agent via PowerShell with administrator privileges to apply the configuration change:

   > Restart-Service -Name wazuh
   

Useful filtering keys

• eventType: This specifies the type of event. These events are activityCreateEvent, activityTransitionEvent, logEvent, signpostEvent, stateEvent, timesyncEvent, traceEvent and userActionEvent.

• eventMessage: Specifies the pattern within the message text or activity name of a log/trace entry.

• messageType: This is used to filter the logs by their level of verbosity, and it works only for logEvent and traceEvent. The possible values you can filter by are: default, info, debug, error, or fault.

• process: This specifies the name of the process that generated the event.

• processImagePath: This specifies the full path of the process that generated the event.

• sender: This represents the name of the library, framework, kernel extension, or mach-o image that originated the event.

• senderImagePath: This represents the full path of the library, framework, kernel extension, or mach-o image that originated the event.

• subsystem: This specifies the subsystem used to log an event. It only works with log messages generated with os_log(3) APIs.

• category: This is the category used to log an event. Only works with log messages generated with os_log(3) APIs. The subsystem filter should also be provided when the category filter is used.

Basic comparison operators

• =, ==: The left-hand expression equals the right-hand expression.

• >=, =>: The left-hand expression is greater than or equal to the right-hand expression.

• <=, =<: The left-hand expression is less than or equal to the right-hand expression.

• >: The left-hand expression is greater than the right-hand expression.

• <: The left-hand expression is less than the right-hand expression.

• !=, <>: The left-hand expression is not equal to the right-hand expression.

• BETWEEN: The left-hand expression is between, or equal to either of, the values specified on the right-hand side. The right-hand side is a two-value array. An array is required to specify the order, giving upper and lower bounds. For example, 1 BETWEEN { 0, 33 }, or processID BETWEEN { 15320, 16000 }.

Basic compound predicates

• AND, &&: represents a logical AND.

• OR, ||: represents a logical OR.

• NOT, !: represents a logical NOT.

String comparison operators

String comparison operators are by default case and diacritic-sensitive. You can modify an operator using the key characters c and d within square braces to specify case and diacritic insensitivity respectively. For example, processImagePath BEGINSWITH[cd] "/usr/libexec" matches any process whose full path starts with either /usr/libexec, or /USR/LIBEXEC.

• BEGINSWITH: The left-hand expression begins with the right-hand expression.

• CONTAINS: The left-hand expression contains the right-hand expression.

• ENDSWITH: The left-hand expression ends with the right-hand expression.

• LIKE: The left-hand expression equals the right-hand expression. You can use ? and * as wildcard characters. ? matches 1 character and * matches 0 or more characters.

• MATCHES: The left-hand expression equals the right-hand expression using a regex-style comparison according to ICU v3. For more information, see the ICU User Guide for Regular Expressions.

• IN: Equivalent to an SQL IN operation, the left-hand side must appear in the collection specified by the right-hand side. For example, category IN { 'APBonjourCache', 'cas', 'client' }.