{"action":"opened","issue":{"url":"https://api.github.com/repos/wazuh/wazuh-ruleset/issues/77","repository_url":"https://api.github.com/repos/wazuh/wazuh-ruleset","labels_url":"https://api.github.com/repos/wazuh/wazuh-ruleset/issues/77/labels{/name}","comments_url":"https://api.github.com/repos/wazuh/wazuh-ruleset/issues/77/comments","events_url":"https://api.github.com/repos/wazuh/wazuh-ruleset/issues/77/events","html_url":"https://github.com/wazuh/wazuh-ruleset/issues/77","id":264602756,"number":77,"title":"Rule: 18107 (level 3) -> 'Windows Logon Success","user":{"login":"keith-mo","id":26066427,"avatar_url":"https://avatars1.githubusercontent.com/u/26066427?v=4","gravatar_id":"","url":"https://api.github.com/users/keith-mo","html_url":"https://github.com/keith-mo","followers_url":"https://api.github.com/users/keith-mo/followers","following_url":"https://api.github.com/users/keith-mo/following{/other_user}","gists_url":"https://api.github.com/users/keith-mo/gists{/gist_id}","starred_url":"https://api.github.com/users/keith-mo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/keith-mo/subscriptions","organizations_url":"https://api.github.com/users/keith-mo/orgs","repos_url":"https://api.github.com/users/keith-mo/repos","events_url":"https://api.github.com/users/keith-mo/events{/privacy}","received_events_url":"https://api.github.com/users/keith-mo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-10-11T14:12:54Z","updated_at":"2017-10-11T14:12:54Z","closed_at":null,"author_association":"NONE","body":"Hi,\r\n\r\nCurrently migrating from wazuh 1.1 to 2.1\r\n\r\nWe have a number of rules custom rules that work off rule 18107 in 0220-msauth_rules.xml.\r\n\r\n`<rule id=\"18107\" level=\"3\">\r\n    <if_sid>18104</if_sid>\r\n    <id>^528$|^540$|^673$|^4624$|^4769$</id>\r\n    <description>Windows Logon Success.</description>\r\n    <group>authentication_success,pci_dss_10.2.5,</group>\r\n  </rule>`\r\n\r\nWe no longer get alerts when we specify individual users in the <user> syntax\r\n\r\n`<rule id=\"100005\" level=\"3\">\r\n    <if_sid>18107</if_sid>\r\n    <id>^4624$</id>\r\n    <match>Logon Type:   10</match>\r\n    <hostname>server1|server2</hostname>\r\n    <user>^user1|^user2</user>\r\n    <description>logon alert for serversx</description>\r\n  </rule>`\r\n\r\nexample of log from alert log\r\n\r\n** Alert 1507730218.1797861: - windows,authentication_success,pci_dss_10.2.5,\r\n2017 Oct 11 14:56:58 (server1) xx.xx.xx.xx->WinEvtLog\r\nRule: 18107 (level 3) -> 'Windows Logon Success.'\r\nSrc IP: xx.xx.xx.xx\r\n**User: (no user)**\r\n2017 Oct 11 14:56:57 WinEvtLog: Security: AUDIT_SUCCESS(4624): Microsoft-Windows-Security-Auditing: **(no user)**: no domain: server1.testdomain.com: An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  server1$   Account Domain:  testdomain   Logon ID:  0x    Logon Type:   10    Impersonation Level:  Impersonation    New Logon:   Security ID:  S-1-5-21-   Account Name:  user1   Account Domain:  server1   Logon ID:  0x   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x   Process Name:  C:\\Windows\\System32\\winlogon.exe    Network Information:   Workstation Name: server1   Source Network Address: xx.xx.xx.xx   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Ser\r\ntype: Security\r\nsubject.security_id: S-1-5-18\r\nsubject.account_name: server1$\r\nsubject.account_domain: testdomain\r\nsubject.logon_id: 0x\r\nsecurity_id: \r\naccount_name: user1\r\naccount_domain: server1\r\nlogon_type: 10\r\n\r\nI've noticed in wazuh 2.1 that no matter what user you logon with the log reports the user as **User: (no user)** this doesnt happen in 1.1 its populate with the actual logged on user.\r\n\r\ni think this might be the causing the alert not to generate...\r\n"}}
{"actor":{"display_login":"keith-mo"}}