Having Windows Parser Issue

Forum|Forum|1 year ago
December 18, 2024
4 replies
1465 views

Hi guys,

I am using a windows agent with 7.1.0 Agent, some fields in the incoming log are not parsed and some fields in the incidents in the default rules it hits are empty. Normally, I think there should not be such a situation in the default parser. When I test the incoming log in the parser, I get an error. Has anyone encountered this situation?

Sample log as a anonymously: 2024-12-18T07:35:23Z SERVER.anonymized.com 10.0.0.1 AccelOps-WUA-WinLog-Application [phCustId]="XXXX" [customer]="ANON-CUST" [monitorStatus]="Success" [Locale]="xx-XX" [MachineGuid]="00000000-0000-0000-0000-000000000000" [timeZone]="+0000" [extEventRecvProto]="Windows Agent" [eventName]="Application" [eventSource]="MSSQLSERVER" [eventId]="18456" [eventType]="Information" [domain]="" [computer]="SERVER.anonymized.com" [user]="" [userSID]="" [userSIDAcctType]="" [eventTime]="Dec 18 2024 07:35:23" [deviceTime]="Dec 18 2024 07:35:23" [msg]="Login failed for user 'ANON-USER'. Reason: Failed to open the explicitly specified database 'ANON_DB'. [CLIENT: 10.0.0.2]"

Thank you

Secusaurus

Contributor III

Hi @adem_netsys,

We experience different parsing of Windows Agent logs in every version of the cluster and the agent. It seems like they constantly change how the Agent sends and how the FSM parses the received information.

So, in our experience, make sure that Agent and cluster match in their versions and the most recent Content Update is installed.

Best,

Christian

NSE8 | Fortinet Advanced MSSP Partner

adem_netsysAuthor

Explorer III

@Secusaurus

I actually tried this in a test environment with a content update and an updated version and the result was the same. Since it is known that a custom parser has been passed before, there may be a different formatting here. How can I separate the user and client ip information in the message without breaking the rest of the parser because the general rule is empty since these fields come as message in the incident.

cdurkin_FTNT

Staff

So I believe with that version of FortiSIEM, you event would be matching the WinOSWmiParser

If you are comfortable editing parsers, you can add this extra <case> statement below to the xml that is processing the 18456 eventId

<case>   <collectAndSetAttrByRegex src="$_body"> 	<regex><![CDATA[.*Login failed for user '<user:patStrQuote>'\..*?\[CLIENT: <_srcId:gPatStrRightSB>\]]]></regex>   </collectAndSetAttrByRegex> </case>

Appologies, I do not have a 7.1 box, but on my 7.2 version this function was around line 3777

(Also, note there seems to be duplication of this event code in the parser ,so if you see the same, make sure you edit the later, longer entry)

The net result will parse your user and IP