Hi All,
We have an remote DC, to save bandwidth and Splunk license we like to filter out computer account logon messages.
Using Splunk UFW 6.2.4
EventCode=4624
Example eventlog message:
An account was successfully logged on. Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: NT AUTHORITY\SYSTEM Account Name: DC01$ Account Domain: AAA-BBB Logon ID: 0x2d71a99b Logon GUID: .......
Account Name is listed twice, if the second Account Name directive is an computer account (ending with a $) the event should be blacklisted and not forwarded to the indexer.
I added the following to the inputs.conf in de deployment-apps/Splunk_TA_windows/local:
blacklist3 = EventCode="4624" Message="Account\sName:\s.*Account\sName:\s(\S+\$)"
Why is this not working? Tested the regex on https://regex101.com/ and it looks fine?
Blacklisting just EventCode="4624" is working fine but that’s not what we want.
Also tried the following, all not working while regex101 shows the regex is ok.
blacklist3 = EventCode="4624" Message="(?:.*?Account Name:){2}\s(\S+)\$"
blacklist3 = EventCode="4624" Message="Account Name:\s(\S+).+Account Name:\s(\S+)\$"
blacklist3 = EventCode="4624" Message="Account\sName:.*Account\sName:\s[\S+]+[\$]"
Thanks in advance,
One problem I see is that you are specifying a single space between "Account Name:" and whatever comes after, but in all my windows event logs I have multiple spaces between "Account Name" and the account name.
So
Account\sName:.*Account\sName:\s[\S+]+[\$]
might need to be
Account\sName:.*Account\sName:\s+[\S+]+[\$]
. Can you give that a try on some of your examples and see if it helps?
If it doesn't, try limiting your blacklist to either/any of the "Account Name:" ending in $ being blocked, get that working and it should be a simple matter to extend it to the second one.
And, otherwise, post back with whatever new revelations you've had from those!
One problem I see is that you are specifying a single space between "Account Name:" and whatever comes after, but in all my windows event logs I have multiple spaces between "Account Name" and the account name.
So
Account\sName:.*Account\sName:\s[\S+]+[\$]
might need to be
Account\sName:.*Account\sName:\s+[\S+]+[\$]
. Can you give that a try on some of your examples and see if it helps?
If it doesn't, try limiting your blacklist to either/any of the "Account Name:" ending in $ being blocked, get that working and it should be a simple matter to extend it to the second one.
And, otherwise, post back with whatever new revelations you've had from those!
Thanks for your fast response.
You pointed me in the right direction.
I tested my regex against the consolidated message field, not the original Windows Eventlog Message.
The original Eventlog Message contains tabs and newline chars.
An account was successfully logged on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
New Logon:
Security ID: SYSTEM
Account Name: DC01$
Account Domain: AAA-BBB
....
Solved it with the following regex blacklist entry:
blacklist3 = EventCode="4624" Message="Account\sName:.*[\S\s]*Account\sName:\s+[\S+]+[\$]"
Derksr,
I tried your regex blacklist entry but it did it not work... did it work for you? Here is how mine look:
blacklist3 = Eventcode="^4624" Message="^Logon\sType:\s+[3]" Message=".*Account\sName:.*[\S\s]*Account\sName:\s+[a-zA-Z0-9-]+[\$]"
Yes mine worked great.
I've checked your regex with https://www.regex101.com/#python (did you?)
The following works for me:
Message="Account\sName:.*[\S\s]*Logon\sType:\s+[3][\S\s]*Account\sName:\s+[\S+]+[\$]"
So 1 message directive.
Looks like the following is what you want: (watch out for capitals EventCode != Eventcode )
blacklist3 = EventCode="4624" Message="Account\sName:.*[\S\s]*Logon\sType:\s+[3][\S\s]*Account\sName:\s+[\S+]+[\$]"
Derksr,
You were right on point... I typed eventcode rather than EventCode. It seems to be working!
Thanks!