3.3 fix windows decoder

[MiguelCasaresRobles]

Hi team,

I have fixed decoder 0380-windows_decoder.xml for ISS logs and extracted new useful fields. With this modification, logs like these will be seen with these new fields:

2015-07-28 15:07:26 1.2.3.4 GET /QOsa/Browser/Default.aspx UISessionId=SN1234123&DeviceId=SN12312232SHARP+MX-4111N 80 - 31.3.3.7 OpenSystems/1.0;+product-family="85";+product-version="123ER123" 302 0 0 624

**Phase 1: Completed pre-decoding.
       full event: '2015-07-28 15:07:26 1.2.3.4 GET /QOsa/Browser/Default.aspx UISessionId=SN1234123&DeviceId=SN12312232SHARP+MX-4111N 80 - 31.3.3.7 OpenSystems/1.0;+product-family="85";+product-version="123ER123" 302 0 0 624'
       timestamp: '(null)'
       hostname: 'miguel-VirtualBox'
       program_name: '(null)'
       log: '2015-07-28 15:07:26 1.2.3.4 GET /QOsa/Browser/Default.aspx UISessionId=SN1234123&DeviceId=SN12312232SHARP+MX-4111N 80 - 31.3.3.7 OpenSystems/1.0;+product-family="85";+product-version="123ER123" 302 0 0 624'

**Phase 2: Completed decoding.
       decoder: 'windows-date-format'
       action: 'GET'
       url: '/QOsa/Browser/Default.aspx UISessionId=SN1234123&DeviceId=SN12312232SHARP+MX-4111N'
       srcport: '80'
       srcip: '31.3.3.7'
       user_agent: 'OpenSystems/1.0;+product-family="85";+product-version="123ER123"'
       id: '302'

**Phase 3: Completed filtering (rules).
       Rule id: '31108'
       Level: '0'
       Description: 'Ignored URLs (simple queries).

Regards,

Miguel Casares

[Lopuiz]

Decoder web-accesslog-iis-default don't mach

2015-03-11 21:59:09 1.2.3.4 GET /console/faces/com_sun_web_ui/jsp/version/version_30.jsp - 80 - 31.3.3.7 Sun+Web+Console+Fingerprinter/7.15 - 404 0 2 0


**Phase 1: Completed pre-decoding.
       full event: '2015-03-11 21:59:09 1.2.3.4 GET /console/faces/com_sun_web_ui/jsp/version/version_30.jsp - 80 - 31.3.3.7 Sun+Web+Console+Fingerprinter/7.15 - 404 0 2 0'
       timestamp: '(null)'
       hostname: 'lopezziur-S551LN'
       program_name: '(null)'
       log: '2015-03-11 21:59:09 1.2.3.4 GET /console/faces/com_sun_web_ui/jsp/version/version_30.jsp - 80 - 31.3.3.7 Sun+Web+Console+Fingerprinter/7.15 - 404 0 2 0'

**Phase 2: Completed decoding.
       decoder: 'windows-date-format'
       url: '/console/faces/com_sun_web_ui/jsp/version/version_30.jsp -'
       srcip: '-'
       id: '404'

**Phase 3: Completed filtering (rules).
       Rule id: '31101'
       Level: '5'
       Description: 'Web server 400 error code.'
**Alert to be generated.

And this PR solve this problem:

2015-03-11 20:28:21 1.2.3.4 GET /certsrv/Default.asp - 80 - 31.3.3.7 Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+WOW64;+Trident/7.0) - 401 2 5 0


**Phase 1: Completed pre-decoding.
       full event: '2015-03-11 20:28:21 1.2.3.4 GET /certsrv/Default.asp - 80 - 31.3.3.7 Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+WOW64;+Trident/7.0) - 401 2 5 0'
       timestamp: '(null)'
       hostname: 'lopezziur-S551LN'
       program_name: '(null)'
       log: '2015-03-11 20:28:21 1.2.3.4 GET /certsrv/Default.asp - 80 - 31.3.3.7 Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+WOW64;+Trident/7.0) - 401 2 5 0'

**Phase 2: Completed decoding.
       decoder: 'windows-date-format'
       action: 'GET'
       url: '/certsrv/Default.asp -'
       srcport: '80'
       srcip: '31.3.3.7'
       user_agent: 'Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+WOW64;+Trident/7.0)'
       id: '401'

**Phase 3: Completed filtering (rules).
       Rule id: '31101'
       Level: '5'
       Description: 'Web server 400 error code.'
**Alert to be generated.

we have to merge this branch as soon as possible

[jsanchez91]

Hi!
I come here from a community question. A user asked about this, I tried this change in Wazuh v3.9.2

2015-03-11 22:01:58 1.2.3.4 GET /IISADMPWD/aexp.htr - 80 - 31.3.3.7 - - 404 0 2 0


**Phase 1: Completed pre-decoding.
       full event: '2015-03-11 22:01:58 1.2.3.4 GET /IISADMPWD/aexp.htr - 80 - 31.3.3.7 - - 404 0 2 0'
       timestamp: '(null)'
       hostname: 'master'
       program_name: '(null)'
       log: '2015-03-11 22:01:58 1.2.3.4 GET /IISADMPWD/aexp.htr - 80 - 31.3.3.7 - - 404 0 2 0'

**Phase 2: Completed decoding.
       decoder: 'windows-date-format'
       action: 'GET'
       url: '/IISADMPWD/aexp.htr -'
       srcport: '80'
       srcip: '31.3.3.7'
       user_agent: '-'
       id: '404'

**Phase 3: Completed filtering (rules).
       Rule id: '31101'
       Level: '5'
       Description: 'Web server 400 error code.'
**Alert to be generated.

[Lopuiz]

Hi team!

It should be noted what this user reports about it.

Regards, Eva