Security_560_Security Events for FileAudting / GPOAuditing / Etc

[RSAAdmin]

Version 3.7.0 build 0169

I hope this helps . . . it took me a few to get to the bottom of this one.

My main objective was to audit Microsoft AD GPO addtions, modifications, and deletions.  For the life of me I could not find the actual file being audited in the parsed data anywhere.  I could see the raw event being captured with the data I needed via the MessageView . . . but running reports, query, and alerts would not show the file being audited in the Misc Name field (which is where it is supposed to be).

I found the following to be true . . . it took me a bit of digging to get this point. 

The XML for the winevent_nic was not parsing the data properly.  The data field misc_name was being used twice in the same content string . . . which means the latter use was overwriting the first.   Look at message Security_560_Security:02 for example . . . Object Name: <misc_name> is the first instance and then later in the content string Image File Name: <misc_name> . . . the latter value kept showing up in Alerts, Query, and Reports.

SOLUTION:  Rename the data field that was mapping to Image File Name.  I created two new messages to get the content I needed . . . mapping Image File Name to  a bogus_field.  The two messages I used to solve my issue, Security_560_Security:04 and Security_560_Security:05, can be seen below . . . 05 accounts for a random space in the incoming MS message. 

<MESSAGE 
        level="4"  
        parse="1"  
        parsedefvalue="1"  
        tableid="5"  
        id1="Security_560_Security:04"  
        id2="Security_560_Security"  
        eventcategory="1401010000"  
        summary="NIC_B_WINDOWS;sumtype=11;|NIC_B_WINDOWS;key=event_computer;sumtype=12;|NIC_B_WINDOWS;key=event_type;sumtype=13;|NIC_B_WINDOWS;key=category;sumtype=14;|NIC_B_CATEGORIES;sumtype=denied_in;|NIC_B_CATEGORIES;subkey=event_log;sumtype=connection;"        
        content="&lt;@utcstamp:*UTC($MSG,'%B %D %N:%U:%O %W',datetime)&gt;&lt;@categorybject_Access&gt; &lt;@event_user:*RMQ(event_user)&gt;&lt;event_log&gt;,&lt;linenum&gt;,&lt;day&gt; &lt;datetime&gt;,&lt;event_id&gt;,&lt;event_source&gt;,&lt;event_user&gt;,&lt;event_type&gt;,&lt;event_computer&gt;,&lt;category&gt;,&lt;data&gt;,&lt;event_description&gt;:&lt;space&gt;Object Server: &lt;obj_server&gt;Object Type: &lt;obj_type&gt;Object Name: &lt;misc_name&gt;Handle ID: &lt;handle_id&gt;Operation ID: &lt;operation_id&gt;Process ID: &lt;process&gt;Image File Name: &lt;bogus_field&gt;Primary User Name: &lt;username&gt;Primary Domain: &lt;domain&gt;Primary Logon ID: &lt;logon_id&gt;Client User Name: &lt;c_user_name&gt;Client Domain: &lt;c_domain&gt;Client Logon ID: &lt;c_logon_id&gt;Accesses &lt;accesses&gt;Privileges &lt;privileges&gt;Restricted Sid Count: &lt;fld4&gt;Access Mask: &lt;peer_id&gt;" />
<MESSAGE 
        level="4"  
        parse="1"  
        parsedefvalue="1"  
        tableid="5"  
        id1="Security_560_Security:05"  
        id2="Security_560_Security"  
        eventcategory="1401010000"  
        summary="NIC_B_WINDOWS;sumtype=11;|NIC_B_WINDOWS;key=event_computer;sumtype=12;|NIC_B_WINDOWS;key=event_type;sumtype=13;|NIC_B_WINDOWS;key=category;sumtype=14;|NIC_B_CATEGORIES;sumtype=denied_in;|NIC_B_CATEGORIES;subkey=event_log;sumtype=connection;"        
        content="&lt;@utcstamp:*UTC($MSG,'%B %D %N:%U:%O %W',datetime)&gt;&lt;@categorybject_Access&gt; &lt;@event_user:*RMQ(event_user)&gt;&lt;event_log&gt;,&lt;linenum&gt;,&lt;day&gt; &lt;datetime&gt;,&lt;event_id&gt;,&lt;event_source&gt;,&lt;event_user&gt;,&lt;event_type&gt;,&lt;event_computer&gt;,&lt;category&gt;,&lt;data&gt;,&lt;event_description&gt;: &lt;space&gt; Object Server: &lt;obj_server&gt; Object Type: &lt;obj_type&gt; Object Name: &lt;misc_name&gt; Handle ID: &lt;handle_id&gt; Operation ID: &lt;operation_id&gt; Process ID: &lt;process&gt; Image File Name: &lt;bogus_field&gt; Primary User Name: &lt;username&gt; Primary Domain: &lt;domain&gt; Primary Logon ID: &lt;logon_id&gt; Client User Name: &lt;c_user_name&gt; Client Domain: &lt;c_domain&gt; Client Logon ID: &lt;c_logon_id&gt; Accesses &lt;accesses&gt; Privileges &lt;privileges&gt; Restricted Sid Count: &lt;fld4&gt; " />
 

[RSAAdmin]

I was having a similar problem and submitted it as a bug to support.  They had a new XML for me that took care of it.

Sometimes it's worth a support case to fix something that should be working rather than having to go through all that trouble to do it.

That said, great job!!

[RSAAdmin]

Believe me . . . I had support cases open on this one.

[RSAAdmin]

Maybe they fixed it based on your solution

[RSAAdmin]

Yeah, since we're on the topic of winevent_nicmsg.xml I recall I ran across a very similar issue just the other day  (yes I reported it by opening a case), this one was specific to the Security_566_Security:02 message ID.   Turns out a trailing colon is missing from "accesses". 

Instead of reading      Accesses&lt;accesses&gt;
It should really read    Accesses:&lt;accesses&gt;

Sounds very minimal, but its amazing what that extra : will do when you're trying to hard code exact filter statements against the Accesses field in correlation rules.  I had to learn to put ": " in front of all of them to accommodate for the .xml. 

I'm on version 3.5.2 and my current winevent_nicmsg.xml states:

<MESSAGE
  level="4"
  parse="1"
  parsedefvalue="1"
  tableid="5"
  id1="Security_566_Security:02"
  id2="Security_566_Security"
  eventcategory="1206000000"
  summary="NIC_B_WINDOWS;sumtype=11;|NIC_B_WINDOWS;key=event_computer;sumtype=12;|NIC_B_WINDOWS;key=event_type;sumtype=13;|NIC_B_WINDOWS;key=category;sumtype=14;|NIC_B_CATEGORIES;sumtype=denied_in;|NIC_B_CATEGORIES;subkey=event_log;sumtype=connection;"  
  content="&lt;@utcstamp:*UTC($MSG,'%B %D %N:%U:%O %W',datetime)&gt;&lt;@categorybject_Access&gt; &lt;@event_user:*RMQ(event_user)&gt;&lt;event_log&gt;,&lt;linenum&gt;,&lt;day&gt; &lt;datetime&gt;,&lt;event_id&gt;,&lt;event_source&gt;,&lt;event_user&gt;,&lt;event_type&gt;,&lt;event_computer&gt;,&lt;category&gt;,&lt;data&gt;,&lt;event_description&gt;: &lt;space&gt; Operation Type: &lt;type&gt;Object Type: &lt;obj_type&gt;Object Name: &lt;misc_name&gt;Handle ID: &lt;handle_id&gt;Primary User Name: &lt;username&gt;Primary Domain: &lt;domain&gt;Primary Logon ID: &lt;logon_id&gt;Client User Name: &lt;c_user_name&gt;Client Domain: &lt;c_domain&gt;Client Logon ID: &lt;c_logon_id&gt;Accesses&lt;accesses&gt;Properties: &lt;fld5&gt;Additional Info: &lt;info1&gt;Additional Info2: &lt;info2&gt;Access Mask: &lt;peer_id&gt;" />

cheers,

ryan

[RSAAdmin]

Update:   I got a response back on my case that this has been resolved.  I think, the same problem was found across 4 or 5 other winevent_nic event IDs.    I'm pretty sure this has been fixed in the recent Device Update package that came out last week.

[RSAAdmin]

Boy, I'm glad I checked the forums on this - I was just in the process of developing a report based on file auditing to determine who deleted a file, and noticed the same thing - the Object Name was listed in the message viewer, but not in the query.  I had not yet downloaded the Device Update package - just did so, and it sounds like that should take care of my issue as well.  If not, thanks for the information on the messages!

[RSAAdmin]

I just checked the documentation on the latest device update package - no windows events at all.  Sounds like I will have to call them about getting a new .xml for windows events.