Error parsing a Fleet agent data from Windows machine

[trb143]

Version

2.4.20

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

16

RAM

32

Storage for /

500gb

Storage for /nsm

1000gb

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

Reviewing messages from one of our windows desktop - via Fleet Agent (from Dashboard) I noticed the following message in the error field. I do have sysmon also installed on the desktop.

failed in Fleet agent final_pipeline: Text '2023-10-27T13:05:42.466Z' could not be parsed at index 20

This is all I have in Kibana.

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[kimobu]

I had the same issue with some Windows Event Logs I was pushing. In Elastic:

1. go to Stack Management -> Ingest Pipelines -> .fleet_final_pipeline-1
2. Edit the pipeline.
3. Find the Date processor (3rd from the bottom)
4. Edit the processor
5. Under Formats, add yyyy-MM-dd'T'HH:mm:ss.SSS'Z' as an expected date format

Fleet will now parse your date field correctly.