From 8c890639f60d4ad78d663b06d6e2e3fd56b85fb1 Mon Sep 17 00:00:00 2001
From: Dylan Myers <dylan.myers@observiq.com>
Date: Tue, 9 Jun 2026 14:47:03 -0400
Subject: [PATCH] fix(wel): correct RenderingInfo format (wrap Keywords, add
 Culture)

---
 generator/wel/event.go      | 10 +++++--
 generator/wel/event_test.go | 55 ++++++++++++++++++++++++++++++++++++-
 2 files changed, 61 insertions(+), 4 deletions(-)

diff --git a/generator/wel/event.go b/generator/wel/event.go
index 45a1d4c..4acf5f6 100644
--- a/generator/wel/event.go
+++ b/generator/wel/event.go
@@ -78,7 +78,7 @@ func (e *EventRecord) ToXML() string {
 
 	// RenderingInfo
 	if e.Message != "" || e.LevelName != "" || e.TaskName != "" {
-		b.WriteString("  <RenderingInfo>\n")
+		b.WriteString("  <RenderingInfo Culture=\"en-US\">\n")
 		if e.Message != "" {
 			fmt.Fprintf(&b, "    <Message>%s</Message>\n", xmlEscape(e.Message))
 		}
@@ -91,8 +91,12 @@ func (e *EventRecord) ToXML() string {
 		if e.OpcodeName != "" {
 			fmt.Fprintf(&b, "    <Opcode>%s</Opcode>\n", xmlEscape(e.OpcodeName))
 		}
-		for _, kw := range e.KeywordNames {
-			fmt.Fprintf(&b, "    <Keyword>%s</Keyword>\n", xmlEscape(kw))
+		if len(e.KeywordNames) > 0 {
+			b.WriteString("    <Keywords>\n")
+			for _, kw := range e.KeywordNames {
+				fmt.Fprintf(&b, "      <Keyword>%s</Keyword>\n", xmlEscape(kw))
+			}
+			b.WriteString("    </Keywords>\n")
 		}
 		b.WriteString("  </RenderingInfo>\n")
 	}
diff --git a/generator/wel/event_test.go b/generator/wel/event_test.go
index 1329c51..aaa83de 100644
--- a/generator/wel/event_test.go
+++ b/generator/wel/event_test.go
@@ -55,7 +55,7 @@ func TestEventRecordToXML(t *testing.T) {
 		`<Data Name="SubjectUserSid">S-1-5-18</Data>`,
 		`<Data Name="TargetUserName">jsmith</Data>`,
 		`<Data Name="LogonType">3</Data>`,
-		`<RenderingInfo>`,
+		`<RenderingInfo Culture="en-US">`,
 		`<Message>An account was successfully logged on.</Message>`,
 		`<Level>Information</Level>`,
 		`<Task>Logon</Task>`,
@@ -69,6 +69,59 @@ func TestEventRecordToXML(t *testing.T) {
 	}
 }
 
+func TestEventRecordToXMLRenderingInfoKeywordsWrapper(t *testing.T) {
+	rec := &EventRecord{
+		ProviderName:  "Microsoft-Windows-Security-Auditing",
+		EventID:       4624,
+		Channel:       "Security",
+		Computer:      "WIN-SERVER01.contoso.com",
+		Keywords:      0x8020000000000000,
+		KeywordNames:  []string{"Audit Success"},
+		Message:       "An account was successfully logged on.",
+		LevelName:     "Information",
+		TimeCreated:   time.Date(2024, 3, 15, 10, 30, 0, 0, time.UTC),
+		EventRecordID: 12345,
+	}
+
+	xml := rec.ToXML()
+
+	// Per the WEL schema, <Keyword> elements inside <RenderingInfo> must be
+	// wrapped in a <Keywords> container. This is distinct from the System-level
+	// <Keywords>0x...</Keywords> hex bitmask.
+	wantBlock := "    <Keywords>\n      <Keyword>Audit Success</Keyword>\n    </Keywords>\n"
+	if !strings.Contains(xml, wantBlock) {
+		t.Errorf("RenderingInfo keywords not wrapped in <Keywords> container.\nwant block:\n%s\nfull XML:\n%s", wantBlock, xml)
+	}
+
+	// A bare <Keyword> directly under <RenderingInfo> (4-space indent, no wrapper)
+	// is the non-conformant form and must not appear.
+	if strings.Contains(xml, "  <RenderingInfo>\n    <Keyword>") {
+		t.Errorf("found bare <Keyword> directly under <RenderingInfo> (missing <Keywords> wrapper)\n\nfull XML:\n%s", xml)
+	}
+}
+
+func TestEventRecordToXMLRenderingInfoCulture(t *testing.T) {
+	rec := &EventRecord{
+		ProviderName:  "Microsoft-Windows-Security-Auditing",
+		EventID:       4624,
+		Channel:       "Security",
+		Computer:      "WIN-SERVER01.contoso.com",
+		KeywordNames:  []string{"Audit Success"},
+		Message:       "An account was successfully logged on.",
+		LevelName:     "Information",
+		TimeCreated:   time.Date(2024, 3, 15, 10, 30, 0, 0, time.UTC),
+		EventRecordID: 12345,
+	}
+
+	xml := rec.ToXML()
+
+	// Per the WEL schema, the RenderingInfo element carries a required Culture
+	// attribute, and real (WEC-forwarded, rendered-text) events always include it.
+	if !strings.Contains(xml, `<RenderingInfo Culture="en-US">`) {
+		t.Errorf("RenderingInfo missing required Culture attribute.\n\nfull XML:\n%s", xml)
+	}
+}
+
 func TestEventRecordToXMLNoGUID(t *testing.T) {
 	rec := &EventRecord{
 		ProviderName: "Service Control Manager",