Add an Event Log Activity Class

[mikeradka]

Related Issue:

#839 Event Log Activity eg 'Audit Log Cleared'

Description of changes:

This PR introduces a new class designed for actions related to monitoring the System Event Log Service.

[jasonbreimer]

What about a "set-log" activity id? I'm looking at the various detections written against event log activities and I see the concept of event log configuration setting modification. An entity can modify settings regarding the event log using wevtutil command set-log.

[jasonbreimer]

Another thought...when looking at clear event log it looks like there are return code status values. This list is oddly limited linked below but I see "success" and "privilege missing". Do we want to capture the successful event or get down to this next layer of capturing a failure by adding some kind of status/return code for each activity id?

https://learn.microsoft.com/en-us/previous-versions/windows/desktop/eventlogprov/cleareventlog-method-in-class-win32-nteventlogfile

[mikeradka]

Another thought...when looking at clear event log it looks like there are return code status values. This list is oddly limited linked below but I see "success" and "privilege missing". Do we want to capture the successful event or get down to this next layer of capturing a failure by adding some kind of status/return code for each activity id?

https://learn.microsoft.com/en-us/previous-versions/windows/desktop/eventlogprov/cleareventlog-method-in-class-win32-nteventlogfile

That is a good find! Thanks for the suggestion - will take a look at what is possible, it seems like this may be good context to capture.

EDIT: After checking this out, I think status_code and status_detail should work for this. I added more specific descriptions for these attributes within the context of this class, and gave the info in this page as examples.

[mikeradka]

Created Issue #1047 to address the discrepancy in validation failure output.

[mikeradka]

What about a "set-log" activity id? I'm looking at the various detections written against event log activities and I see the concept of event log configuration setting modification. An entity can modify settings regarding the event log using wevtutil command set-log.

This is a good suggestion, @jasonbreimer. I took a look at the Microsoft wevtutil documentation, and it notes:

Enables you to retrieve information about event logs and publishers. You can also use this command to install and uninstall event manifests, to run queries, and to export, archive, and clear logs.

The Archive, and Clear actions are covered, and I've added Export to the actions. However, I am not yet certain on how we should approach uninstall event manifests and run queries. Maybe Uninstall and Query actions are sufficient, but I would like to get some further inputs.

@floydtree, @pagbabian-splunk, @k2niner any thoughts on whether Uninstall and Query could work as activities for this new class?

[pagbabian-splunk]

What about a "set-log" activity id? I'm looking at the various detections written against event log activities and I see the concept of event log configuration setting modification. An entity can modify settings regarding the event log using wevtutil command set-log.

This is a good suggestion, @jasonbreimer. I took a look at the Microsoft wevtutil documentation, and it notes:

Enables you to retrieve information about event logs and publishers. You can also use this command to install and uninstall event manifests, to run queries, and to export, archive, and clear logs.

The Archive, and Clear actions are covered, and I've added Export to the actions. However, I am not yet certain on how we should approach uninstall event manifests and run queries. Maybe Uninstall and Query actions are sufficient, but I would like to get some further inputs.

@floydtree, @pagbabian-splunk, @k2niner any thoughts on whether Uninstall and Query could work as activities for this new class?

If we don't yet know how to address these two activities, we can hold off until we do, and add them later. Unless @jasonbreimer or others have a use case of course. I haven't researched it so I don't have any informed suggestion at the moment.