Windows Applocker XML Events Missing user data (renderXML=1)

[phoenixdigital]

Hi All,

I will likely file this as a bug report but was just going to check here first.

A customer recently activated XML Windows Events across the board and we noticed that the Applocker Events are missing a few things.

The old text event (obfuscated):

12/07/2015 09:38:54 AM
LogName=microsoft-windows-applocker/exe and dll
SourceName=Microsoft-Windows-AppLocker
EventCode=8004
EventType=2
Type=Error
ComputerName=xxxxxxxxxx.prod
User=cxxxxrn
Sid=S-1-5-xx-1xxxx40-23xxxx4-32xxxx7-3xxx
SidType=1
TaskCategory=None
OpCode=Info
RecordNumber=10360
Keywords=None
Message=%OSDRIVE%\USERS\xxxxxxx\APPDATA\xxxxxxxxxxxxx\xxxxxxxxxxx\ADOBECAPTIVATEWS was prevented from running.

The new XML Version:

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
    <System>
        <Provider Name='Microsoft-Windows-AppLocker' Guid='{xxxxxx}'/>
        <EventID>8002</EventID>
        <Version>0</Version>
        <Level>4</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8000000000000000</Keywords>
        <TimeCreated SystemTime='2015-12-07T00:49:18.186112800Z'/>
        <EventRecordID>147067</EventRecordID>
        <Correlation/>
        <Execution ProcessID='8092' ThreadID='5804'/>
        <Channel>microsoft-windows-applocker/exe and dll</Channel>
        <Computer>xxxxxxxxxxx.prod</Computer>
        <Security UserID='S-1-5-xx-181xxxxx-23xxx-32xxxxxx-13345'/>
    </System>
    <UserData>
        <RuleAndFileData xmlns:auto-ns2='http://schemas.microsoft.com/win/2004/08/events' xmlns='http://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0'>
            <PolicyName>EXE</PolicyName>
            <RuleId>{xxxxxxxxxxx}</RuleId>
            <RuleName>xxxxxx: JExplorer32.3.3.exe</RuleName>
            <RuleSddl>D:(XA;;FX;;;S-1-1-0;(APPID://SHA256HASH Any_of {#1ce1604845axxxxxxxxxxxxxxd2e0cc2}))</RuleSddl>
            <TargetUser>S-1-5-xx-181xxxxx-23xxx-32xxxxxx-13345</TargetUser>
            <TargetProcessId>1484</TargetProcessId>
            <FilePath>%OSDRIVE%\USERS\xxxxxx\APPDATA\LOCAL\TEMP\1\JEXPLORER32.3.3.EXE</FilePath>
            <FileHash>1CE160484xxxxxxxxxxxxxxDD2E0CC2</FileHash>
            <Fqbn>-</Fqbn>
        </RuleAndFileData>
    </UserData>
</Event>

One key field most of our dashboards used was the "User" field which is no longer available in the XML version of these events. The only other option is the TargetUser which obviously relates to the User (Sid) but is not really a human friendly. Seems a bit pointless to have to make a lookup from TargetUser -> User.

Is there any way we can control how renderXML works for Windows Events like Applocker?

Thanks

[phoenixdigital · Accepted solution]

Turns out the issue is a Windows issue and not Splunk. The XML format can be viewed with Windows Event Viewer so if something is missing it is because Windows did not put it there. 😞

Sadly we have switched back to plaintext events for Applocker. Windows disappoints yet again.

More information can be found here.
https://answers.splunk.com/answers/290844/testing-renderxml1-for-windows-event-logs-in-splun.html

[jonathan_cooper]

I am seeing this on a customer site now as well, it impacts the Enterprise Security app also as it has no "action" field extraction which originates from a lookup that bases it on the "Type" field, which also does not exist.

Hoping Splunk can speak to this soon as it does impact current customer deployments.