update in accordance with update 4.10.1-1 wazuh

crowdsecurity · Jan 22, 2025 · 101e72a · 101e72a
1 parent f320ed6
commit 101e72a
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/parsers/s01-parse/bouddha/wazuh-logs.yaml b/parsers/s01-parse/bouddha/wazuh-logs.yaml
@@ -13,7 +13,7 @@ statics:
           evt.Unmarshaled.wazuh.type == 'response' &&
           evt.Unmarshaled.wazuh.method == 'post' &&
           evt.Unmarshaled.wazuh.statusCode in [401, '401'] &&
-          evt.Unmarshaled.wazuh.req.url == '/auth/login'
+          evt.Unmarshaled.wazuh.req.url == '/auth/login?dataSourceId='
         ) ? 'wazuh_failed_auth' : ''
   - meta: timestamp
     expression: evt.Unmarshaled.wazuh['@timestamp']