I have received logs in archives and tested them in wazuh-logtest. It runs fine but it gives nothing in alerts.log, how can I test the decoder that it working fine and generating events and alerts on wazuh dashboard?
here is my decoder
<decoder name="windows">
<prematch>USB</prematch>
</decoder>
<decoder name="windows-usb">
<parent>windows</parent>
<prematch>EventChannel </prematch>
<plugin_decoder offset="after_prematch">JSON_Decoder</plugin_decoder>
</decoder>
Rules:
<group name="windows-usb,syslog,">
<rule id="500015" level="3">
<decoded_as>windows</decoded_as>
<description>USB log detected</description>
</rule>
<rule id="500016" level="3">
<if_sid>500015</if_sid>
<regex>USBSTOR</regex>
<description>USB in WINDOWS Detected</description>
</rule>
</group>
sample Logs:
2022 Sep 13 09:59:26 (SHAHZADI-59) any->EventChannel {"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-09-13T09:59:25.2635330Z","eventRecordID":"3289631","processID":"4","threadID":"18620","channel":"Security","computer":"SHAHZADI-59","severityValue":"AUDIT_SUCCESS","message":""A new external device was recognized by the system.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSHAHZADI-59$\r\n\tAccount Domain:\t\tWORKGROUP\r\n\tLogon ID:\t\t0x3E7\r\n\r\nDevice ID:\tUSB\VID_048D&PID_1234\2839451125099311468\r\n\r\nDevice Name:\tUSB Mass Storage Device\r\n\r\nClass ID:\t\t{36fc9e60-c465-11cf-8056-444553540000}\r\n\r\nClass Name:\tUSB\r\n\r\nVendor IDs:\t\r\n\t\tUSB\VID_048D&PID_1234&REV_0200\r\n\t\tUSB\VID_048D&PID_1234\r\n\t\t\r\n\t\t\r\n\r\nCompatible IDs:\t\r\n\t\tUSB\Class_08&SubClass_06&Prot_50\r\n\t\tUSB\Class_08&SubClass_06\r\n\t\tUSB\Class_08\r\n\t\t\r\n\t\t\r\n\r\nLocation Information:\t\r\n\t\tPort_#0002.Hub_#0002\r\n\t\t""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"SHAHZADI-59$","subjectDomainName":"WORKGROUP","subjectLogonId":"0x3e7","deviceId":"USB\\VID_048D&PID_1234\\2839451125099311468","deviceDescription":"USB Mass Storage Device","classId":"{36fc9e60-c465-11cf-8056-444553540000}","className":"USB","vendorIds":" USB\\VID_048D&PID_1234&REV_0200 USB\\VID_048D&PID_1234","compatibleIds":" USB\\Class_08&SubClass_06&Prot_50 USB\\Class_08&SubClass_06 USB\\Class_08","locationInformation":" Port_#0002.Hub_#0002"}}} 2022 Sep 13 09:59:26 (SHAHZADI-59) any->EventChannel {"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"6416","version":"1","level":"0","task":"13316","opcode":"0","keywords":"0x8020000000000000","systemTime":"2022-09-13T09:59:25.2745239Z","eventRecordID":"3289632","processID":"4","threadID":"18620","channel":"Security","computer":"SHAHZADI-59","severityValue":"AUDIT_SUCCESS","message":""A new external device was recognized by the system.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSHAHZADI-59$\r\n\tAccount Domain:\t\tWORKGROUP\r\n\tLogon ID:\t\t0x3E7\r\n\r\nDevice ID:\tUSBSTOR\Disk&Ven_Flash&Prod_Disk_3.0&Rev_2.00\2839451125099311468&0\r\n\r\nDevice Name:\tFlash Disk 3.0 USB Device\r\n\r\nClass ID:\t\t{4d36e967-e325-11ce-bfc1-08002be10318}\r\n\r\nClass Name:\tDiskDrive\r\n\r\nVendor IDs:\t\r\n\t\tUSBSTOR\DiskFlash___Disk_3.0________2.00\r\n\t\tUSBSTOR\DiskFlash___Disk_3.0________\r\n\t\tUSBSTOR\DiskFlash___\r\n\t\tUSBSTOR\Flash___Disk_3.0________2\r\n\t\tFlash___Disk_3.0________2\r\n\t\tUSBSTOR\GenDisk\r\n\t\tGenDisk\r\n\t\t\r\n\t\t\r\n\r\nCompatible IDs:\t\r\n\t\tUSBSTOR\Disk\r\n\t\tUSBSTOR\RAW\r\n\t\tGenDisk\r\n\t\t\r\n\t\t\r\n\r\nLocation Information:\t-""},"eventdata":{"subjectUserSid":"S-1-5-18","subjectUserName":"SHAHZADI-59$","subjectDomainName":"WORKGROUP","subjectLogonId":"0x3e7","deviceId":"USBSTOR\\Disk&Ven_Flash&Prod_Disk_3.0&Rev_2.00\\2839451125099311468&0","deviceDescription":"Flash Disk 3.0 USB Device","classId":"{4d36e967-e325-11ce-bfc1-08002be10318}","className":"DiskDrive","vendorIds":" USBSTOR\\DiskFlash___Disk_3.0________2.00 USBSTOR\\DiskFlash___Disk_3.0_______ USBSTOR\\DiskFlash__ USBSTOR\\Flash___Disk_3.0________2 Flash___Disk_3.0________2 USBSTOR\\GenDisk GenDisk","compatibleIds":" USBSTOR\\Disk USBSTOR\\RAW GenDisk"}}}