I have restarted OSSEC using the OSSEC Agent Manager on the ossec client
computer. I have also restarted the OSSEC service on the OSSEC server.
I'm not sure why I can't reply to your response, so I had to reply to mine
@dan(ddpbsd)
On Friday, November 6, 2015 at 11:00:00 AM UTC-6, Phillipa Moorea wrote:
>
> I'm having issues trying to setup logging for PowerShell.
>
>
> I started out creating a powershell profile file
> ("C:\Winodws\System32\WindowsPowerShell\v1.0\Profile.ps1") with the
> following lines of code:
> $LogCommandHealth = $true
> $LogCommandLifecycleEvent = $true
>
>
> This allowed me to get Windows Event Logs for PowerShell commands.
> This is the Windows Event log
> path: %SystemRoot%\System32\Winevt\Logs\Windows PowerShell.evtx
>
> On the OSSEC client I enabled logging for the PowerShell event log by
> adding this to ossec.conf:
> <localfile>
> <location>Windows PowerShell</location>
> <log_format>eventlog</log_format>
> </localfile>
>
> To get the logs on the OSSEC server at
> /var/ossec/logs/archives/archives.log, I added this to
> /var/ossec/etc/ossec.conf file under the "<global>" section:
> <logall>yes</logall>
>
> I need to get the logs to show up in the alert logs though at
> /var/ossec/logs/alerts/alerts.log. They do not show up?
>
> The log inside archives.log looks like this:
> *2015 Nov 06 10:20:11 (HOSTNAME) 192.168.5.1->WinEvtLog 2015 Nov 06
> 10:20:08 WinEvtLog: Windows PowerShell: INFORMATION(500): PowerShell: (no
> user): no domain: HOSTNAME.DOMAIN.com <http://HOSTNAME.DOMAIN.com>:
> Get-Host Started NewCommandState=Started*
>
> * SequenceNumber=127*
>
> * HostName=ConsoleHost*
> * HostVersion=2.0*
> * HostId=2ff69cc2-302d-4d7c-baef-f57106d8c4b3*
> * EngineVersion=2.0*
> * RunspaceId=261b4763-f866-4b2a-a472-eae41e3c0d72*
> * PipelineId=9*
> * CommandName=Get-Host*
> * CommandType=Cmdlet*
> * ScriptName=*
> * CommandPath=*
> * CommandLine=Get-Host*
>
> I tried to run /var/ossec/bin/ossec-logtest and paste in the log, but it
> doesn't work because of all the newlines. So then I tried just pasting in
> the first line to the command and got this output:
> ***Phase 1: Completed pre-decoding.*
> * full event: '2015 Nov 06 10:20:11
> (HOSTNAME) 192.168.5.1->WinEvtLog 2015 Nov 06 10:20:08 WinEvtLog: Windows
> PowerShell: INFORMATION(500): PowerShell: (no user): no
> domain: HOSTNAME.DOMAIN.com <http://HOSTNAME.DOMAIN.com>: Get-Host Started'*
> * hostname: 'alien'*
> * program_name: '(null)'*
> * log: '2015 Nov 06 10:20:11 (HOSTNAME) 192.168.5.1->WinEvtLog 2015
> Nov 06 10:20:08 WinEvtLog: Windows PowerShell: INFORMATION(500):
> PowerShell: (no user): no domain: HOSTNAME.DOMAIN.com
> <http://HOSTNAME.DOMAIN.com>: Get-Host Started'*
>
> ***Phase 2: Completed decoding.*
> * No decoder matched.*
>
> ***Phase 3: Completed filtering (rules).*
> * Rule id: '100212'*
> * Level: '5'*
> * Description: 'Powershell Command.'*
> ***Alert to be generated.*
>
> So it says "Alert to be generated", but I never get an alert. Also it
> shows "No decoder matched". Do I have to have a decoder in order to get an
> alert? How do I write a decoder for this? But my main question is how do
> I get an alert?
>
> Any help would be greatly appreciated!!! Because I am now lost
>
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
