Need help with filter (seems to be picking up all values not just the two desired)

[roman-tasi]

This is my filter:

filter:
- query:
    bool:
      must:
      - term:
          winlog.provider_name: "Microsoft-Windows-Sysmon"
      - term:
          event.code: 11
      - wildcard:
          winlog.event_data.TargetFilename: "C:\Users\*\Desktop\*"
      - wildcard:
          winlog.event_data.TargetFilename: "C:\Users\*\Documents\*"

I successfully received an alert with the winlog.event_data.TargetFilename: C:\Users\roman\Desktop\owl.jpg so the wildcard is working correctly in that case. However I am also receiving alerts with winlog.event_data.TargetFilename: C:\Users\amihan\AppData\Roaming\Microsoft\Office\Recent\Project Strategy Overview.LNK so it isn't working correctly there. Any idea what the solution could be?

Also I am receiving this error in my docker logs:

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/bin/elastalert", line 8, in <module>
    sys.exit(main())
  File "/usr/local/lib/python3.10/site-packages/elastalert/elastalert.py", line 2155, in main
    client = ElastAlerter(args)
  File "/usr/local/lib/python3.10/site-packages/elastalert/elastalert.py", line 128, in __init__
    self.rules = self.rules_loader.load(self.conf, self.args)
  File "/usr/local/lib/python3.10/site-packages/elastalert/loaders.py", line 170, in load
    raise EAException('Error loading file %s: %s' % (rule_file, e))
elastalert.util.EAException: Error loading file /etc/elastalert/elastalert_rules/sysmon-file-create.yaml: Could not parse file /etc/elastalert/elastalert_rules/sysmon-file-create.yaml: while scanning a double-quoted scalar
  in "<unicode string>", line 13, column 45:
     ... nlog.event_data.TargetFilename: "C:\Users\*\Desktop\*"
                                         ^
expected escape sequence of 8 hexadecimal numbers, but found 's'
  in "<unicode string>", line 13, column 50:
     ... event_data.TargetFilename: "C:\Users\*\Desktop\*"

                                     ^

[jertel]

Backslashes in quoted strings need to be escaped. Ex: \\.

There are many existing docs and forums online that explain how to write an OR filter for Elasticsearch.

[roman-tasi]

I'm trying this now:

filter:
- query:
    bool:
      must:
      - term:
          winlog.provider_name: "Microsoft-Windows-Sysmon"
      - term:
          event.code: 11
      should:
      - term:
          dirname: "Desktop"
      - term:
          dirname: "Documents"

The log should be
winlog.provider_name: "Microsoft-Windows-Sysmon" AND event.code: 11 AND (dirname: "Desktop" OR dirname: "Documents")

However it seems to be picking up on dirnames, not just the Desktop or Documents.

[jertel]

You may need to specify minimum_should_match: 1. Alternatively, consider writing the query using a query_string format, similar to your example above.

The Elastic community will be better able to assist with writing complex queries.

[roman-tasi]

Solved with the minimum_should_match: 1