r/Wazuh•
Some-Pen-Tester

Wazuh - Adding field to index pattern

Good day,

i wanna add a new field to my wazuh-alerts-* for specific events "A network share object was accessed." - Event ID 5140.

I have following as field in my events:

https://preview.redd.it/4s3wmz20w9yf1.png?width=614&format=png&auto=webp&s=e5458ef0d91f678072ab7bdbde7a9f06297a9d98

But i need the "Accesses" field as well:

https://preview.redd.it/5zt70or3w9yf1.png?width=900&format=png&auto=webp&s=ade345a537de9135c46d07bb6d3652f6fe55f3f5

Any hint how to achieve this?

data.win.eventdata.Accesses = ReadData
data.win.eventdata.accessMask = 0x1

Cheers & thanks in regards

Posted Oct 30, 2025, 4:07 PM UTC

36
Loading comments…