Unable to blacklist Windows events with regex on universal forwarder

[Derksr]

Hi All,

We have an remote DC, to save bandwidth and Splunk license we like to filter out computer account logon messages.
Using Splunk UFW 6.2.4
EventCode=4624
Example eventlog message:

An account was successfully logged on. Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: NT AUTHORITY\SYSTEM Account Name: DC01$ Account Domain: AAA-BBB Logon ID: 0x2d71a99b Logon GUID: .......

Account Name is listed twice, if the second Account Name directive is an computer account (ending with a $) the event should be blacklisted and not forwarded to the indexer.

I added the following to the inputs.conf in de deployment-apps/Splunk_TA_windows/local:

blacklist3 = EventCode="4624" Message="Account\sName:\s.*Account\sName:\s(\S+\$)"

Why is this not working? Tested the regex on https://regex101.com/ and it looks fine?
Blacklisting just EventCode="4624" is working fine but that’s not what we want.

Also tried the following, all not working while regex101 shows the regex is ok.

blacklist3 = EventCode="4624" Message="(?:.*?Account Name:){2}\s(\S+)\$"
blacklist3 = EventCode="4624" Message="Account Name:\s(\S+).+Account Name:\s(\S+)\$"
blacklist3 = EventCode="4624" Message="Account\sName:.*Account\sName:\s[\S+]+[\$]"

Thanks in advance,

[Richfez · Accepted solution]

One problem I see is that you are specifying a single space between "Account Name:" and whatever comes after, but in all my windows event logs I have multiple spaces between "Account Name" and the account name.

So
Account\sName:.*Account\sName:\s[\S+]+[\$] might need to be
Account\sName:.*Account\sName:\s+[\S+]+[\$]. Can you give that a try on some of your examples and see if it helps?

If it doesn't, try limiting your blacklist to either/any of the "Account Name:" ending in $ being blocked, get that working and it should be a simple matter to extend it to the second one.

And, otherwise, post back with whatever new revelations you've had from those!

[Derksr]

Thanks for your fast response.

You pointed me in the right direction.
I tested my regex against the consolidated message field, not the original Windows Eventlog Message.
The original Eventlog Message contains tabs and newline chars.

An account was successfully logged on.

    Subject:
        Security ID:        NULL SID
        Account Name:       -
        Account Domain:     -
        Logon ID:       0x0

    Logon Type:         3

    New Logon:
        Security ID:        SYSTEM
        Account Name:       DC01$
        Account Domain:     AAA-BBB
    ....

Solved it with the following regex blacklist entry:

blacklist3 = EventCode="4624" Message="Account\sName:.*[\S\s]*Account\sName:\s+[\S+]+[\$]"

[kmedina1]

Derksr,

I tried your regex blacklist entry but it did it not work... did it work for you? Here is how mine look:

blacklist3 = Eventcode="^4624" Message="^Logon\sType:\s+[3]" Message=".*Account\sName:.*[\S\s]*Account\sName:\s+[a-zA-Z0-9-]+[\$]"

[Derksr]

Yes mine worked great.

I've checked your regex with https://www.regex101.com/#python (did you?)
The following works for me:

Message="Account\sName:.*[\S\s]*Logon\sType:\s+[3][\S\s]*Account\sName:\s+[\S+]+[\$]"

So 1 message directive.

Looks like the following is what you want: (watch out for capitals EventCode != Eventcode )

blacklist3 = EventCode="4624" Message="Account\sName:.*[\S\s]*Logon\sType:\s+[3][\S\s]*Account\sName:\s+[\S+]+[\$]"

[kmedina1]

Derksr,

You were right on point... I typed eventcode rather than EventCode. It seems to be working!

Thanks!