Getting Data In

WinEventLog Security Regex

barne_dn
Explorer

Hi Everyone,

I have windows security event filter setup and working on my indexer. However I want to filter on three variables.

The logic is as follows: Keep all events, except the ones that match the regex.

My current filter looks like this:

[dropevents]
REGEX = (?msi)^EventCode=(123|678|910).*^(User=userxxx)
DEST_KEY = queue
FORMAT = nullQueue

I want to add one more variable to the filter (Type=Success Audit).

Also, in the future I may want to add a hostname to this regex, so that it only filters out these events on a certain host, so once host name is added it would be filtering on 4 variables.

Thanks!

Tags (1)
0 Karma

BP9906
Builder

This works like a charm.

/opt/splunk/etc/system/local/transform.conf

#Exclude Sample User Authentication Events
[nullFilter-user1]
REGEX=(?ism)EventCode\s*=\s*(123|456|789).*User\s*=\s*user
DEST_KEY=queue
FORMAT=nullQueue

/opt/splunk/etc/system/local/props.conf

[source::WinEventLog:Security]
TRANSFORMS-nullQ=nullFilter-user1

I do this to filter out all sorts of things. 🙂
Enjoy.

0 Karma

barne_dn
Explorer

What would be syntax for adding to the regex. I've only seen examples of addting two variables to a regex, not three or four.

0 Karma

dturnbull_splun
Splunk Employee
Splunk Employee

Do you need to filter these independently or dependently? i.e. must we match the eventcode, type and user and host? or is it some combination, i.e eventcode+host or eventcode+user? for the former, just add to your regex, for the later, add multiple stanzas.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...