Actually that was enough info... Got it working now... Sometimes you can't see the most obvious things... Thanks!
On Thursday, November 26, 2015 at 12:37:59 PM UTC, dan (ddpbsd) wrote: > > > On Nov 26, 2015 5:57 AM, <[email protected] <javascript:>> wrote: > > > > Incredibly basic rule(s), as follows to get a match to the software > restriction policies on a MS pc. > > > > <rule id="100037" level="11"> > > <match>WARNING(865)</match> > > <description>Tried to run something from the wrong area</description> > > </rule> > > > > Also tried > > > > <rule id="100036" level="11"> > > <match>SoftwareRestrictionPolicies</match> > > <description>Tried to run something from the wrong area</description> > > </rule> > > > > and > > <rule id="100035" level="11"> > > <match>Microsoft-Windows-SoftwareRestrictionPolicies</match> > > <description>Tried to run something from the wrong area</description> > > </rule> > > > > > > Log test produces the following > > > > > > ossec-testrule: Type one log per line. > > > > 015 Nov 25 13:19:08 (seuk-d15) 192.168.10.71->WinEvtLog 2015 Nov 25 > 13:19:06 WinEvtLog: Application: WARNING(865): Microsoft-Windows-Softwa > > reRestrictionPolicies: > > > > You copied the archives.log header along with the log message. I doubt > that's the problem, but I can't test at the moment. > > > > > **Phase 1: Completed pre-decoding. > > full event: '015 Nov 25 13:19:08 (seuk-d15) > 192.168.10.71->WinEvtLog 2015 Nov 25 13:19:06 WinEvtLog: Application: > WARNING(865): Micr > > osoft-Windows-SoftwareRestrictionPolicies:' > > hostname: 'ossec' > > program_name: '(null)' > > log: '015 Nov 25 13:19:08 (seuk-d15) 192.168.10.71->WinEvtLog > 2015 Nov 25 13:19:06 WinEvtLog: Application: WARNING(865): Microsoft-W > > indows-SoftwareRestrictionPolicies:' > > > > **Phase 2: Completed decoding. > > No decoder matched. > > > > **Phase 3: Completed filtering (rules). > > Rule id: '100037' > > Level: '11' > > Description: 'Tried to run something from the wrong area' > > **Alert to be generated. > > > > > > > > > > So looks good, all three have matched under logtest (the test line is > copied from the archive file after logall applied...) > > But I get no alerts after restarting . Its so basic, I can't see what > can possibly be wrong, but been looking at it for over a day now and > starting to go abit mad ;-) > > And ideas ? Please ? > > > > -- > > > > --- > > You received this message because you are subscribed to the Google > Groups "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send > an email to [email protected] <javascript:>. > > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
