I have this event and I'm trying to send it to the nullQueue if it contains SYSTEM.
2013-10-24 15:02:34,Major,REMOVED,Allowed, - Caller MD5=61b1dfb9703d0d678e108e0156fcbb69,Create Process,Begin: 2013-10-24 15:02:20,End: 2013-10-24 15:02:20,Rule: This one is a splat | Watch these Executables,1504,C:/Program Files/VMware/VMware Tools/vmtoolsd.exe,0,No Module Name,C:/Windows/System32/net.exe,User: SYSTEM,Domain: WORKGROUP,Action Type:
source = D:\Program Files\Symantec\Symantec Endpoint Protection Manager\data\dump\agt_behavior.tmp
sourcetype = sep_behavior
My props.conf is set to this:
[sep_behavior]
TRANSFORMS-set=setnull1
And my transforms.conf is set to this:
[setnull1]
REGEX = /User: SYSTEM/m
DEST_KEY = queue
FORMAT = nullQueue
Your regex does not look right.
You can try this:
,\User:\s\SYSTEM,
Or this if User is a field:
(?msi)^User:\sSYSTEM