Unable to save valid Windows EventChannel QueryList query in agent.conf editor

[rodrigofez]

Description

Fixed XML validation to allow escaped XML syntax (\<...\>) inside <query> tags for Windows EventChannel log collection configuration.

When configuring Windows EventChannel monitoring using the <QueryList> syntax, XML labels inside the <query> tag need to be escaped (for example: \<QueryList\>, \<Query Id="0"\>). The Dashboard XML validation was incorrectly rejecting this configuration, preventing users from saving files.

More specifically, a false error positive was happening when escaping > in tags, like this: \>.

Following changes were made:

• Created a custom "wazuh" XML mode for the Ace editor to avoid having false positives in the highlights of the code editor (EuiCodeEditor uses Ace editor).
• Updated validateXML function to handle \> escaping.
• Added extra unit test in the XML test suite.

Wazuh documentation - Log data collection explains how syntax should be escaped when using the <QueryList> syntax.

Issues Resolved

• Unable to save valid Windows EventChannel QueryList query in agent.conf editor #8084

Evidence

Screen.Recording.2026-02-04.at.14.13.04.mov

Test

1. Navigate to Server management => Endpoints Summary => Groups
2. Click on Edit group configuration for any group
3. Add the following configuration to the agent.conf:

<agent_config>
    <localfile>
        <location>Security</location>
        <log_format>eventchannel</log_format>
        <query>
            \<QueryList\>
            \<Query Id="0" Path="Security"\>
                \<Select Path="Security"\>Event/System[EventID != 5145 and EventID != 5156 and EventID != 5447 and EventID != 4656 and EventID != 4658 and EventID != 4663 and EventID != 4660 and EventID != 4670 and EventID != 4690 and EventID != 4703 and EventID != 4907 and EventID != 5152 and EventID != 5157]\</Select\>
                \<Suppress Path="Security"\>*[System[EventID=4634]] and *[EventData[Data[@Name='TargetDomainName']='VIRTUAL USERS']] or *[System[EventID=4634]] and *[EventData[Data[@Name='TargetDomainName']='Window Manager']] or *[System[EventID=4634]] and *[EventData[Data[@Name='TargetDomainName']='Font Driver Host']]\</Suppress\>
            \</Query\>
            \</QueryList\>
        </query>
    </localfile>
</agent_config>

4. Verify:

• No XML validation error appears
• No error indicators in the code editor
• Save button is enabled and configuration saves successfully
• Other XML configurations still validate correctly

Unit Tests

Check List

• All tests pass
  • yarn test:jest
• New functionality includes testing.
• New functionality has been documented.
• Update CHANGELOG.md
• Commits are signed per the DCO using --signoff

[github-actions]

Wazuh Core plugin code coverage (Jest) test	%	values
Statements	48.3%	( 443 / 917 )
Branches	43.9%	( 173 / 394 )
Functions	44.81%	( 147 / 328 )
Lines	48.45%	( 440 / 908 )

[github-actions]

Wazuh Check Updates plugin code coverage (Jest) test	%	values
Statements	78.72%	( 185 / 235 )
Branches	62.72%	( 69 / 110 )
Functions	61.7%	( 29 / 47 )
Lines	78.72%	( 185 / 235 )

[github-actions]

Main plugin code coverage (Jest) test	%	values
Statements	18.34%	( 5779 / 31506 )
Branches	12.75%	( 2564 / 20101 )
Functions	19.02%	( 1470 / 7727 )
Lines	18.54%	( 5624 / 30327 )

[Ripdiegozz]

🟢 CR
🟢 Tests

Tests

1. Navigate to Server management => Endpoints Summary => Groups
2. Click on Edit group configuration for any group
3. Add the following configuration to the agent.conf:

 <agent_config>
  <localfile>
     <location>Security</location>
     <log_format>eventchannel</log_format>
     <query>
       \<QueryList\>
         \<Query Id="0" Path="Security"\>
           \<Select Path="Security"\>Event/System[EventID != 5145 and EventID != 5156 and EventID != 5447 and EventID != 4656 and EventID != 4658 and EventID != 4663 and EventID != 4660 and EventID != 4670 and EventID != 4690 and EventID != 4703 and EventID != 4907 and EventID != 5152 and EventID != 5157]\</Select\>
           \<Suppress Path="Security"\>*[System[EventID=4634]] and *[EventData[Data[@Name='TargetDomainName']='VIRTUAL USERS']] or *[System[EventID=4634]] and *[EventData[Data[@Name='TargetDomainName']='Window Manager']] or *[System[EventID=4634]] and *[EventData[Data[@Name='TargetDomainName']='Font Driver Host']]\</Suppress\>
         \</Query\>
       \</QueryList\>
       </query>
   </localfile>
 </agent_config>

4. Verify:

• No XML validation error appears
• No error indicators in the code editor
• Save button is enabled and configuration saves successfully
• Other XML configurations (without escaped query tags) still validate correctly

pull-8087.mp4

[Machi3mfl]

CR: ✅
Test: ✅

Screen.Recording.2026-02-06.at.10.17.11.AM.mov