Having Windows Parser Issue

[adem_netsys]

Hi guys,

I am using a windows agent with 7.1.0 Agent, some fields in the incoming log are not parsed and some fields in the incidents in the default rules it hits are empty. Normally, I think there should not be such a situation in the default parser. When I test the incoming log in the parser, I get an error. Has anyone encountered this situation?

Sample log as a anonymously: 2024-12-18T07:35:23Z SERVER.anonymized.com 10.0.0.1 AccelOps-WUA-WinLog-Application [phCustId]="XXXX" [customer]="ANON-CUST" [monitorStatus]="Success" [Locale]="xx-XX" [MachineGuid]="00000000-0000-0000-0000-000000000000" [timeZone]="+0000" [extEventRecvProto]="Windows Agent" [eventName]="Application" [eventSource]="MSSQLSERVER" [eventId]="18456" [eventType]="Information" [domain]="" [computer]="SERVER.anonymized.com" [user]="" [userSID]="" [userSIDAcctType]="" [eventTime]="Dec 18 2024 07:35:23" [deviceTime]="Dec 18 2024 07:35:23" [msg]="Login failed for user 'ANON-USER'. Reason: Failed to open the explicitly specified database 'ANON_DB'. [CLIENT: 10.0.0.2]"

Thank you

[Secusaurus]

Hi @adem_netsys,

We experience different parsing of Windows Agent logs in every version of the cluster and the agent. It seems like they constantly change how the Agent sends and how the FSM parses the received information.

So, in our experience, make sure that Agent and cluster match in their versions and the most recent Content Update is installed.

Best,

Christian

[adem_netsys]

@Secusaurus 

I actually tried this in a test environment with a content update and an updated version and the result was the same. Since it is known that a custom parser has been passed before, there may be a different formatting here. How can I separate the user and client ip information in the message without breaking the rest of the parser because the general rule is empty since these fields come as message in the incident.

[cdurkin_FTNT]

So I believe with that version of FortiSIEM, you event would be matching the WinOSWmiParser

If you are comfortable editing parsers, you can add this extra <case> statement below to the xml that is processing the 18456 eventId

<case>
  <collectAndSetAttrByRegex src="$_body">
	<regex><![CDATA[.*Login failed for user '<user:patStrQuote>'\..*?\[CLIENT: <_srcId:gPatStrRightSB>\]]]></regex>
  </collectAndSetAttrByRegex>
</case>

Appologies, I do not have a 7.1 box, but on my 7.2 version this function was around line 3777



(Also, note there seems to be duplication of this event code in the parser ,so if you see the same, make sure you edit the later, longer entry)

 The net result will parse your user and IP

[adem_netsys]

Hi @cdurkin_FTNT 

Thank you for interest. I added it to the relevant ID as you mentioned, but I continue to get errors.