LucioDonda
commented
1 month ago Update 7/10/2024 and 8/10/2024
Analysis and comparisson of libraries:
1) *Windows Event Log API** (EvtQuery, EvtNext, etc.) :
- Older and more traditional C-style approach
- Part of the Windows SDK
- Provides direct access to event logs
- Can be used with C++, but may require more wrapper code for modern C++ integration
- Pros: Well-documented, stable, and widely supported
- Cons: More verbose, may require more boilerplate code in C++
2) Event Tracing for Windows (ETW):
- More modern approach to event tracing and logging
- Provides real-time and historical event collection
- Offers high-performance event tracing
- Can be used with C++ and integrates well with modern C++ features
- Pros: High performance, flexible, supports real-time monitoring
- Cons: Steeper learning curve, may be overkill for simple event log queries
3) krabsetw:
- Open-source C++ library for ETW
- Provides a modern C++ wrapper around ETW functionality
- Designed to work well with C++11 and later
- Pros: Easier to use than raw ETW, good C++ integration
- Cons: Third-party library, may have less documentation compared to official Microsoft solutions
4) Integrating PowerShell:
- Allows using PowerShell cmdlets from C++ code
- Can leverage PowerShell's Get-WinEvent cmdlet for querying event logs
- Requires setting up PowerShell hosting in C++
- Pros: Flexible, can use PowerShell's rich event querying capabilities
- Cons: Additional overhead of PowerShell runtime, may be slower for large-scale querying
First Approach
Some basic design and tentative approach on how can this be achieved, this should be double checked based on the different libraries limitations and needs:
Class Diagram:
classDiagram
class EventChannelQuerySystem {
- Session session
- Provider provider
- Consumer consumer
-BookmarkManager bookmarkMgr
-QueryBuilder queryBuilder
+initialize()
+startQuery(channelName, queryString)
+stopQuery()
+getResults()
+setReconnectTime(time)
+rotateLog()
}
class Session {
-sessionName
-sessionProperties
+open()
+close()
+enableProvider(provider)
}
class Provider {
}
class Consumer {
-eventCallback
+processEvent(event)
+setEventCallback(callback)
}
class BookmarkManager {
-bookmarks
+createBookmark(event)
+getBookmark(id)
+saveBookmarks()
+loadBookmarks()
}
class QueryBuilder {
+buildQuery(channelName, conditions)
+addWildcardMatch(field, pattern)
}
EventChannelQuerySystem -- Session
EventChannelQuerySystem -- Provider
EventChannelQuerySystem -- Consumer
EventChannelQuerySystem -- BookmarkManager
EventChannelQuerySystem -- QueryBuilder
EventChannelQuerySystem: The main class that orchestrates the entire querying process.Session: Manages the ETW session, including opening, closing, and enabling providers.Provider: Represents an ETW provider, which can be enabled or disabled.Consumer: Processes the events received from the ETW session.BookmarkManager: Handles the creation, saving, and loading of bookmarks.QueryBuilder: Constructs queries, including support for wildcard matches.
Flow chart:
- The system starts by initializing the
ETWQuerySystem. - It opens an ETW session and enables the required provider.
- The ETW consumer is set up to handle incoming events.
- Bookmarks are loaded from persistent storage.
- A query is built using the
QueryBuilder, incorporating channel name and specific query conditions. - The query is started, and the system enters an event processing loop.
- For each received event:
- The event is processed.
- Bookmarks are updated.
- Log rotation is performed if needed.
- The system checks if reconnection is needed and performs it if necessary.
- When the query is stopped, bookmarks are saved, and the session is closed.
graph TD
A[init] --> B[Initialize - ETWQuerySystem]
B --> C[Open - ETWSession]
C --> D[Enable - ETWProvider]
D --> E[Set up - ETWConsumer]
E --> F[Load Bookmarks -> store]
E --> W[(Store)]
F --> G[Build N Queries]
G --> H[run]
H --> I{While Event Received?}
I -->|Yes| J[Process Event]
J --> K[Update Bookmark]
K --> I
I -->|No| N{Query Stopped or shutdown signal ?}
N -->|Yes| O[Save Bookmarks]
O --> P[Close Session]
P --> Q[End]
N -->|No| R{Reconnect Needed?}
R -->|Yes| S[Reconnect]
S --> I
R -->|No| I
cborla
Description
This issue is a section of #201, focuses on implementing the Windows Logcollector module in the Wazuh Agent 5.0.0. The Windows collector will utilize the Event Channel (eventchannel) API to gather system logs, ensuring seamless integration and log management on Windows platforms.
Functional Requirements
Non-functional Requirements
Deliverables
Acceptance Criteria