printer server

[Asyncronick23]

Description

Could you help me? I try to be able to view the impressions from a printer server in the dashboard, I have that json event but it does not appear on the dashboard

localrules.xml


<decoded_as>json</decoded_as>
^Microsoft-Windows-PrintService/Operational$
^307$
Windows printing log


<if_sid>100140</if_sid>
Windows printing log details

Output of the Wazuh-logtest

**Phase 3: Completed filtering (rules).
id: '100141'
level: '10'
description: 'Windows printing log details'
groups: '['windows', ' event logs']'
firedtimes: '1'
mail: 'False'
**Alert to be generated.

Log examples

{"timestamp":"2024-05-10T11:43:19.561-0300","agent":{"id":"009","name":"server-print","ip":"10.30.10.126"},"manager":{"name":"siem"},"id":"1715352199.2144962307","full_log":"{"win":{"system":{"providerName":"Microsoft-Windows-PrintService","providerGuid":"{747EF6FD-E535-4D16-B510-42C90F6873A1}","eventID":"307","version":"0","level":"4","task":"26","opcode":"11","keywords":"0x4000000000000840","systemTime":" 2024-05-10T14:44:37.333511400Z","eventRecordID":"29539886","processID":"19616","threadID":"19748","channel":"Microsoft-Windows-PrintService/Operational","computer":"server-print.empresa.com","severityValue":"INFORMATION","message":"\"El documento 160, PDF.js viewer propiedad de bhansen en \\\\pc-297057 se imprimió en impresora-contable2 mediante el puerto 10.10.4.32. Tamaño en bytes: 7073244. Páginas imprimidas: 1. No se requiere ninguna acción por parte del usuario.\""},"documentPrinted":{"param1":"160","param2":"PDF.js viewer","param3":"soizoiw","param4":"\\\\\\\\pc-297057","param5":"PRT-Civ12","param6":"10.10.4.32","param7":"7073244","param8":"1"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-PrintService","providerGuid":"{ 747EF6FD-E535-4D16-B510-42C90F6873A1}","eventID":"307","version":"0","level":"4","task":"26","opcode":"11","keywords":"0x4000000000000840","systemTime":"2024-05-10T14:44:37.333511400Z","eventRecordID":"29539886","processID":"19616","threadID":"19748","channel":"Microsoft-Windows-PrintService/Operational","computer":"server-print.empresa.com","severityValue":"INFORMATION","message":""El documento 160, PDF.js viewer propiedad de bhansen en \\pc-297057 se imprimió en impresora-contable2 mediante el puerto 10.10.4.32. Tamaño en bytes: 7073244. Páginas imprimidas: 1. No se requiere ninguna acción por parte del usuario.""},"documentPrinted":{"param1":"160","param2":"PDF.js viewer","param3":"bhansen","param4":"\\\\JUS-297057","param5":"PRT-Civ12","param6":"10.10.4.32","param7":"7073244","param8":"1"}}},"location":"EventChannel"}

[jnasselle]

Hi @Asyncronick23 ,

Unfortunately testing Windows EventChannel events using Wazuh logtest mechanisms (Wazuh Dashboard, Wazuh API, or wazuh-logtest CLI) could be really tricky.

Wazuh OOTB ruleset, particularly Windows EventChannel root rule expect a specific decoder that, internally is a JSON, but is named different. This means that testing an Windows Event in JSON format takes a different path into log evaluation.

Here's the suggested procedure to test them #14991 (comment).

I've done this and the next custom rule should work as expected

<group name="local,">

  <rule id="100141" level="10">
    <if_sid>60009</if_sid>
    <field name="win.system.providerName">Microsoft-Windows-PrintService</field>
    <description>Printer was used</description>
    <group>printer,</group>
  </rule>

</group>

Testing it with wazuh-logtest

[root@wazuh-server wazuh-user]# /var/ossec/bin/wazuh-logtest
Starting wazuh-logtest v4.7.3
Type one log per line

{"win": {"system":{"providerName":"Microsoft-Windows-PrintService","providerGuid":"{747EF6FD-E535-4D16-B510-42C90F6873A1}","eventID":"307","version":"0","level":"4","task":"26","opcode":"11","keywords":"0x4000000000000840","systemTime":" 2024-05-10T14:44:37.333511400Z","eventRecordID":"29539886","processID":"19616","threadID":"19748","channel":"Microsoft-Windows-PrintService/Operational","computer":"server-print.empresa.com","severityValue":"INFORMATION","message":"\"El documento 160, PDF.js viewer propiedad de bhansen en \\\\pc-297057 se imprimió en impresora-contable2 mediante el puerto 10.10.4.32. Tamaño en bytes: 7073244. Páginas imprimidas: 1. No se requiere ninguna acción por parte del usuario.\""},"documentPrinted":{"param1":"160","param2":"PDF.js viewer","param3":"soizoiw","param4":"\\\\\\\\pc-297057","param5":"PRT-Civ12","param6":"10.10.4.32","param7":"7073244","param8":"1"}}}

**Phase 1: Completed pre-decoding.
	full event: '{"win": {"system":{"providerName":"Microsoft-Windows-PrintService","providerGuid":"{747EF6FD-E535-4D16-B510-42C90F6873A1}","eventID":"307","version":"0","level":"4","task":"26","opcode":"11","keywords":"0x4000000000000840","systemTime":" 2024-05-10T14:44:37.333511400Z","eventRecordID":"29539886","processID":"19616","threadID":"19748","channel":"Microsoft-Windows-PrintService/Operational","computer":"server-print.empresa.com","severityValue":"INFORMATION","message":"\"El documento 160, PDF.js viewer propiedad de bhansen en \\\\pc-297057 se imprimió en impresora-contable2 mediante el puerto 10.10.4.32. Tamaño en bytes: 7073244. Páginas imprimidas: 1. No se requiere ninguna acción por parte del usuario.\""},"documentPrinted":{"param1":"160","param2":"PDF.js viewer","param3":"soizoiw","param4":"\\\\\\\\pc-297057","param5":"PRT-Civ12","param6":"10.10.4.32","param7":"7073244","param8":"1"}}}'

**Phase 2: Completed decoding.
	name: 'json'
	win.documentPrinted.param1: '160'
	win.documentPrinted.param2: 'PDF.js viewer'
	win.documentPrinted.param3: 'soizoiw'
	win.documentPrinted.param4: '\\\\pc-297057'
	win.documentPrinted.param5: 'PRT-Civ12'
	win.documentPrinted.param6: '10.10.4.32'
	win.documentPrinted.param7: '7073244'
	win.documentPrinted.param8: '1'
	win.system.channel: 'Microsoft-Windows-PrintService/Operational'
	win.system.computer: 'server-print.empresa.com'
	win.system.eventID: '307'
	win.system.eventRecordID: '29539886'
	win.system.keywords: '0x4000000000000840'
	win.system.level: '4'
	win.system.message: '"El documento 160, PDF.js viewer propiedad de bhansen en \\pc-297057 se imprimió en impresora-contable2 mediante el puerto 10.10.4.32. Tamaño en bytes: 7073244. Páginas imprimidas: 1. No se requiere ninguna acción por parte del usuario."'
	win.system.opcode: '11'
	win.system.processID: '19616'
	win.system.providerGuid: '{747EF6FD-E535-4D16-B510-42C90F6873A1}'
	win.system.providerName: 'Microsoft-Windows-PrintService'
	win.system.severityValue: 'INFORMATION'
	win.system.systemTime: ' 2024-05-10T14:44:37.333511400Z'
	win.system.task: '26'
	win.system.threadID: '19748'
	win.system.version: '0'

**Phase 3: Completed filtering (rules).
	id: '100141'
	level: '10'
	description: 'Printer was used'
	groups: '['local', 'printer']'
	firedtimes: '1'
	mail: 'False'
**Alert to be generated.

Hope this helps!
Nico