Splunk Search

Blacklist WinEventLog::/Security with user names ending in $

ericrenfro
New Member

I'm trying to get a blacklisted log entry that works on Universal Forwarders to filter out specific event codes with user fields that end in $ in their value.

What I have now, works on my test environment with uploaded sample logs, but not directly on the Universal Forwarder itself:

blacklist1 = EventCode="(4624|4634)" user=".*\$"
blacklist2 = EventCode="4672" Account_Name=".*\$"

What can I do to get this right so it actually works? I know that in the event log, raw, the matching line actually is space indented and something like:

...
Subject:
  Security ID:    S-1-5-18
  Account Name:   something$
  Account Domain:   domain
...

Thank you!

0 Karma

spayneort
Contributor

Try these:

blacklist1 = EventCode="4624" Message="(?ms)New\sLogon:.*?Account\sName:[^\n]+\$$"
blacklist2 = EventCode="(4634|4672)" Message="(?m)Account\sName:[^\n]+\$$"
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...