u/khan69Ass

Hi guys,
hope everyone is doing well.
I am working on a project where in i have deployed two VMs, one is running windows server with wazuh agent and the other one is running ubuntu on which i have my wazuh manager.
I am trying to run logtest on windows log, starting with 4624 and 4625, the basic ones.
While researching I saw that wazuh has some predefined ruleset for windows. so now to create the custom rules (for 4624 & 4625), I need to add the "if_sid" tag in my custom rules, I cant find a way to logtest my windows logs since i want to check which "rule id" i am supposed to add in "if_sid" to make my custom rules.

I appreciate all your help.

Thank you 😄