Getting Data In

Include Windows Event Log and Exclude LognType

ajith_sukumaran
Explorer

Hi, I have a requirement for forward 4 Windows Log EventCodes 4672, 4673, 4674 & 4624 to a destination from the HWFs, however exclude if these EventCode messages are for the "Logon Type=3" and forward rest everything.

Expected result is something like:

EventCode=4672 & LogonType= 3 : DISCARDED
EventCode=4673 & LogonType= 3 : DISCARDED
EventCode=4675 & LogonType= * : DISCARDED

EventCode=4672 & LogonType= 2 : PROCESSED

etc

Does the below settings in the props and conf really help for this ? Thanks in advance.

cat outputs.conf

[syslog:syslog_destination]
server=:514
type=udp
disabled=false

cat props.conf

[WinEventLog:Security]
TRANSFORMS-routing = routeDestination,excludeDestination

cat transforms.conf

[routeDestination]
REGEX=EventCode=(4672|4673|4674|4624)
DEST_KEY=_SYSLOG_ROUTING
FORMAT=syslog_destination

[excludeDestination]
REGEX=Logon\sType:\t+3
DEST_KEY = queue
FORMAT = nullQueue
0 Karma

3no
Communicator

For the eventCode filtering you can simply use Whitelist in inputs.conf to only collect EventCode 4672, 4673, 4674 & 4624.

https://docs.splunk.com/Documentation/Splunk/8.0.2/Admin/Inputsconf (see whitelist for Windows Event Log Monitor)

And after, only have the excludeDestination as a stanza in your transforms.conf.


Otherwise I think you configuration is okay, but you'll have to change your props.conf to :

 [WinEventLog:Security]
 TRANSFORMS-routing = excludeDestination, routeDestination

Because you want first to discard the Logon_Type=3 then keep the log if the EventCode match, not the other way around because the EventCode will always match and therefore it will always use the routeDestination.

It works like ACL, first matched, first served.

3no

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...