{"action":"created","issue":{"url":"https://api.github.com/repos/ossec/ossec-hids/issues/526","labels_url":"https://api.github.com/repos/ossec/ossec-hids/issues/526/labels{/name}","comments_url":"https://api.github.com/repos/ossec/ossec-hids/issues/526/comments","events_url":"https://api.github.com/repos/ossec/ossec-hids/issues/526/events","html_url":"https://github.com/ossec/ossec-hids/pull/526","id":56266341,"number":526,"title":"possible fix to vista_sec.csv","user":{"login":"ChristianBeer","id":997210,"avatar_url":"https://avatars.githubusercontent.com/u/997210?v=3","gravatar_id":"","url":"https://api.github.com/users/ChristianBeer","html_url":"https://github.com/ChristianBeer","followers_url":"https://api.github.com/users/ChristianBeer/followers","following_url":"https://api.github.com/users/ChristianBeer/following{/other_user}","gists_url":"https://api.github.com/users/ChristianBeer/gists{/gist_id}","starred_url":"https://api.github.com/users/ChristianBeer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ChristianBeer/subscriptions","organizations_url":"https://api.github.com/users/ChristianBeer/orgs","repos_url":"https://api.github.com/users/ChristianBeer/repos","events_url":"https://api.github.com/users/ChristianBeer/events{/privacy}","received_events_url":"https://api.github.com/users/ChristianBeer/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-02-02T17:29:30Z","updated_at":"2015-02-02T18:16:38Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/ossec/ossec-hids/pulls/526","html_url":"https://github.com/ossec/ossec-hids/pull/526","diff_url":"https://github.com/ossec/ossec-hids/pull/526.diff","patch_url":"https://github.com/ossec/ossec-hids/pull/526.patch"},"body":"try to fix #525 I couldn't find the correct descriptions of those event ids. Maybe it's better to just delete them? I don't know how this is used inside OSSEC."},"comment":{"url":"https://api.github.com/repos/ossec/ossec-hids/issues/comments/72507792","html_url":"https://github.com/ossec/ossec-hids/pull/526#issuecomment-72507792","issue_url":"https://api.github.com/repos/ossec/ossec-hids/issues/526","id":72507792,"user":{"login":"awiddersheim","id":3237256,"avatar_url":"https://avatars.githubusercontent.com/u/3237256?v=3","gravatar_id":"","url":"https://api.github.com/users/awiddersheim","html_url":"https://github.com/awiddersheim","followers_url":"https://api.github.com/users/awiddersheim/followers","following_url":"https://api.github.com/users/awiddersheim/following{/other_user}","gists_url":"https://api.github.com/users/awiddersheim/gists{/gist_id}","starred_url":"https://api.github.com/users/awiddersheim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/awiddersheim/subscriptions","organizations_url":"https://api.github.com/users/awiddersheim/orgs","repos_url":"https://api.github.com/users/awiddersheim/repos","events_url":"https://api.github.com/users/awiddersheim/events{/privacy}","received_events_url":"https://api.github.com/users/awiddersheim/received_events","type":"User","site_admin":false},"created_at":"2015-02-02T18:16:38Z","updated_at":"2015-02-02T18:16:38Z","body":"This reads in the file creating a hash:\r\n\r\nhttps://github.com/ossec/ossec-hids/blob/master/src/logcollector/read_win_el.c#L520\r\n\r\nThen this searches the hash using the event ID and formats the message:\r\n\r\nhttps://github.com/ossec/ossec-hids/blob/master/src/logcollector/read_win_el.c#L520"}}