Microsoft Syslog via Snare Agent
WARNING: The Snare Agent not recommended for new installs and is included here only for older setups.
Please use the LogZilla Windows Agent.
Rule Function
There are two rules in this app. The first rule parses MS Windows log
messages as forwarded by the Snare windows agent application. It adds
EventID and EventLog to the message and sets a user tag. This rule
is used as a precursor to the second rule. The second rule sets several
categorization user tags referenced by event id.
Vendor Documentation
Log Source Details
| Item | Value |
|---|---|
| Vendor | Microsoft |
| Device Type | Windows |
| Supported Software Version(s) | Windows XP or later (desktop or server) |
| Collection Method | Syslog |
| Configurable Log Output? | no |
| Log Source Type | Snare Windows agent |
| Exceptions | N/A |
Currently Supported Log Types
These log messages are sent from the Snare agent in a tab-separated format.
| Field Name | Example |
|---|---|
Fixed Message Type |
MSWinEventLog |
Criticality |
0 |
EventLogSource |
Security |
SnareCounter |
12399 |
SubmitTime |
Fri Feb 25 08:15:52 2022 |
EventID |
4689 |
SourceName |
Microsoft-Windows-Security-Auditing |
UserName |
WIN2019-DC-SNAR\Administrator |
SIDType |
N/A |
EventLogType |
Success Audit |
ComputerName |
Win2019-DC-snare |
CategoryString |
Process Termination |
DataString |
(see below) |
ExpandedString |
(not available) |
OptionalMD5Checksum |
(not available) |
The DataString would be something similar to:
A process has exited. Subject: Security ID:
S-1-5-21-889138511-2922568610-3431993163-500 Account Name:
Administrator Account Domain: WIN2019-DC-SNAR Logon ID:
0xF199D4B Process Information: Process ID: 0x12dc Process
Name: C:\Windows\System32\PING.EXE Exit Status: 0x0 12370
NOTE: the Snare log messages are parsed differently by LogZilla;
on receipt, the first four fields are read as the LogZilla program
field and the remainder as the message field.
Parsed Metadata Fields
Note that only the MSWin EventID and Hostname fields are parsed
directly from the log message itself; the remainder of the user tags
come from a listing of the relevant information below, by event id.
| Tagged | Tag Name | Example |
|---|---|---|
| ☑ | MSWin EventID |
4634 |
| ☑ | Hostname |
TestHost |
| ☑ | MSWin Category |
Logon/Logoff |
| ☑ | MSWin Compliance Category |
PCI DSS |
| ☑ | MSWin Criticality |
Low |
| ☑ | MSWin Sub Category |
Account Lockout |
| ☑ | MSWin Failed Login User |
User-20DDC |
| ☑ | MSWin Failed Login Source Network |
106.26.164.208 |
Log Examples
(line breaks between fields in the following examples are not included and have been added for readability:)
Process Termination
MSWinEventLog 0 Security 12399 Feb 25 11:01:19 2022 4689
Microsoft-Windows-Security-Auditing WORKGROUP\WIN2019-DC-SNAR$
N/A Success Audit Win2019-DC-snare Process Termination A process
has exited. Subject: Security ID: S-1-5-18 Account Name: WIN2019-DC-SNAR$
Account Domain: WORKGROUP Logon ID: 0x3E7 Process Information: Process
ID: 0x748 Process Name: C:\Windows\System32\svchost.exe Exit Status: 0x0 12801
Process Creation
Feb 25 11:09:46 2022 4688 Microsoft-Windows-Security-Auditing NT
AUTHORITY\LOCAL SERVICE N/A Success Audit Win2019-DC-snare Process
Creation A new process has been created. Creator Subject: Security
ID: S-1-5-18 Account Name: WIN2019-DC-SNAR$ Account Domain: WORKGROUP
Logon ID: 0x3E7 Target Subject: Security ID: S-1-5-19 Account Name:
LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3E5 Process
Information: New Process ID: 0xf28 New Process Name:
C:\Windows\System32\wbem\WmiPrvSE.exe Token Elevation Type: %%1936
Mandatory Label: S-1-16-16384 Creator Process ID: 0x2e0 Creator Process
Name: C:\Windows\System32\svchost.exe Process Command Line: Token
Elevation Type indicates the type of token that was assigned to the
new process in accordance with User Account Control policy. Type 1
is a full token with no privileges removed or groups disabled. A full
token is only used if User Account Control is disabled or if the user
is the built-in Administrator account or a service account. Type 2 is
an elevated token with no privileges removed or groups disabled. An
elevated token is used when User Account Control is enabled and the
user chooses to start the program using Run as administrator. An
elevated token is also used when an application is configured to always
require administrative privilege or to always require maximum privilege,
and the user is a member of the Administrators group. Type 3 is a limited
token with administrative privileges removed and administrative groups
disabled. The limited token is used when User Account Control is enabled,
the application does not require administrative privilege, and the user
does not choose to start the program using Run as administrator. 12803