can't see alert for message field from sudo.log file

[mikettt11]

I've an Ubuntu 22.04 VM with an Apache HTTP Server installed, with Rsyslog i collect all the logs (sytem and Apache) of the VM and after with rsync i import the logs inside my SecurityOnion Server in this path: home/admin/testin1/, i can see in the dashboards and in Kibana all my logs, after this i craft some Sigma Rule for the Apache HTTP logs detecting a specific url.path and it's works, after i've tried to detect this string "sudo NOT in sudoers" inside the sudo.log file (i've insert the path inside System integration) but the Sigma Rule doesn't generate any alert, example of the full log:
2024-05-20T15:47:54.151541+02:00 user1 sudo: daemon : user NOT in sudoers ; PWD=/ ; USER=root ; COMMAND=/usr/bin/touch file.txt

EXAMPLE of sigma rule:

title: Test111
id: ff463d9a-888e-47e8-89b7-df77500c2d01
status: experimental
description: Detection of sudo command 
references:
    - https://cvedetails.com/
logsource:
    category: linux
detection:
    selection:
        message: 'user NOT in sudoers'
    condition: selection
falsepositives:
    - None
level: critical

I've tried literally everything, how i can detetect a string inside the message field with the SecurityOnion playbook?

---

Version: 2.4.60
Standalone
Security Onion ISO image
1 nodes manager
16GB, 4 CPU in VirtualBox
All services running
Grid --> Elasticsearch Status: Pending

[reyesj2]

Have you tried out
message: '*user NOT in sudoers*' ?

Do you get any hits when you run
sudo so-elasticsearch-query */_eql/search -d'{"query" : "any where message : \"*user NOT in sudoers*\""}' | jq ?

[mikettt11]

Hi, first of all thank you for the answer, yes i've tried but i figure out that the message field is of the match_only_text type so it doesn't match string, i resolved by ticking the option of save the raw log in event.original inside the System integration when i import my logs, and the event.original field is of the keyword type so it works.

Another solution is to manually change the .yaml file in /opt/so/rules/elastalert/playbook changing the filter part from:

- eql: >
   any where message: 'sudo NOT in sudoers"

to

filter:
 - query:
     query_string:
       query: "event.dataset: system.auth AND host.name: sos AND message: *user \NOT in sudoers* AND process.name: sudo"