I was previously using the Seckit template for windows collection given to me by professional services and I noticed that the Splunk*.exe regex they are using was not working with the new xml tags as advertised. This is also in docs as a recommended stanza.
[WinEventLog://Security]
renderXml = true
disabled = false
evt_resolve_ad_obj = true
blacklist1 = EventCode="4662" Message="Object Type:\s+(?!groupPolicyContainer)"
blacklist2 = EventCode="566" Message="Object Type:\s+(?!groupPolicyContainer)"
blacklist3 = EventCode="4688" Message="New Process Name: (?i)(?:[C-F]:\Program Files\Splunk(?:UniversalForwarder)?\bin\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi)).exe)"
I figured because Message isn't the field that is there anymore so I modified it for the Xml tags and it is still not working
[WinEventLog://Security]
renderXml = true
disabled = false
evt_resolve_ad_obj = true
blacklist1 = EventCode="4662" Message="Object Type:\s+(?!groupPolicyContainer)"
blacklist2 = EventCode="566" Message="Object Type:\s+(?!groupPolicyContainer)"
blacklist3 = EventID="4688" NewProcessName=((?i)(?:[C-F]:\\Program Files\\(Splunk|SplunkUniversalForwarder)\\bin\\(?:btool|splunk|splunkd|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi))\.exe)
Use the $XmlRegex key instead of Message.
Use the $XmlRegex key instead of Message.
Any idea what version of Splunk Universal forwarder introduced the $xmlRegex option?
blacklist3 = $XmlRegex="<EventID>4688<\/EventID>.*<Data Name='NewProcessName'>[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi))\.exe"
gathered from