I think this is my same issue, but I am not sure what this means? Is there anyway you can expand a little further on how you got your alert to work? I'm having this same issue for trying to get alerts for PowerShell commands.
On Thursday, November 26, 2015 at 8:52:28 AM UTC-6, [email protected] wrote: > > Actually that was enough info... Got it working now... Sometimes you can't > see the most obvious things... Thanks! > > On Thursday, November 26, 2015 at 12:37:59 PM UTC, dan (ddpbsd) wrote: >> >> >> On Nov 26, 2015 5:57 AM, <[email protected]> wrote: >> > >> > Incredibly basic rule(s), as follows to get a match to the software >> restriction policies on a MS pc. >> > >> > <rule id="100037" level="11"> >> > <match>WARNING(865)</match> >> > <description>Tried to run something from the wrong >> area</description> >> > </rule> >> > >> > Also tried >> > >> > <rule id="100036" level="11"> >> > <match>SoftwareRestrictionPolicies</match> >> > <description>Tried to run something from the wrong >> area</description> >> > </rule> >> > >> > and >> > <rule id="100035" level="11"> >> > <match>Microsoft-Windows-SoftwareRestrictionPolicies</match> >> > <description>Tried to run something from the wrong >> area</description> >> > </rule> >> > >> > >> > Log test produces the following >> > >> > >> > ossec-testrule: Type one log per line. >> > >> > 015 Nov 25 13:19:08 (seuk-d15) 192.168.10.71->WinEvtLog 2015 Nov 25 >> 13:19:06 WinEvtLog: Application: WARNING(865): Microsoft-Windows-Softwa >> > reRestrictionPolicies: >> > >> >> You copied the archives.log header along with the log message. I doubt >> that's the problem, but I can't test at the moment. >> >> > >> > **Phase 1: Completed pre-decoding. >> > full event: '015 Nov 25 13:19:08 (seuk-d15) >> 192.168.10.71->WinEvtLog 2015 Nov 25 13:19:06 WinEvtLog: Application: >> WARNING(865): Micr >> > osoft-Windows-SoftwareRestrictionPolicies:' >> > hostname: 'ossec' >> > program_name: '(null)' >> > log: '015 Nov 25 13:19:08 (seuk-d15) 192.168.10.71->WinEvtLog >> 2015 Nov 25 13:19:06 WinEvtLog: Application: WARNING(865): Microsoft-W >> > indows-SoftwareRestrictionPolicies:' >> > >> > **Phase 2: Completed decoding. >> > No decoder matched. >> > >> > **Phase 3: Completed filtering (rules). >> > Rule id: '100037' >> > Level: '11' >> > Description: 'Tried to run something from the wrong area' >> > **Alert to be generated. >> > >> > >> > >> > >> > So looks good, all three have matched under logtest (the test line is >> copied from the archive file after logall applied...) >> > But I get no alerts after restarting . Its so basic, I can't see what >> can possibly be wrong, but been looking at it for over a day now and >> starting to go abit mad ;-) >> > And ideas ? Please ? >> > >> > -- >> > >> > --- >> > You received this message because you are subscribed to the Google >> Groups "ossec-list" group. >> > To unsubscribe from this group and stop receiving emails from it, send >> an email to [email protected]. >> > For more options, visit https://groups.google.com/d/optout. >> > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
