Good morning everyone, having a bit of a tough time with this, as my blacklists and whitelists aren't working properly. Windows Event 4656 is noisy, and I'm looking to ingest ONLY the events tied to a peron's account, and not the system account. Within Windows, the system account name is denoted by a literal "$" appended to the system name (i.e. COMPUTER$). I've tried various forms of regex within a blacklist, and tried a negative whitelist (i.e. accept all 4656 (?!Account Name:\s+\w+\$)). I've also noticed that if I activate the negative whitelist, the regex also blocks events from EventCode 4670 from showing up. Splunk Enterprise 7.0.2 Splunk Forwarder 7.0.2 05/08/2018 04:16:49 PM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=4656 EventType=0 Type=Information ComputerName=computer.domain.com TaskCategory=Removable Storage OpCode=Info RecordNumber=91946348 Keywords=Audit Success Message=A handle to an object was requested. Subject: Security ID: NT AUTHORITY\SYSTEM Account Name: COMPUTER$ Account Domain: DOMAIN Logon ID: 0x3E7 Object: Object Server: Security Object Type: File Object Name: C:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\application Handle ID: 0x290 Resource Attributes: - Process Information: Process ID: 0x4adc Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe Access Request Information: Transaction ID: {00000000-0000-0000-0000-000000000000} Accesses: READ_CONTROL SYNCHRONIZE WriteData (or AddFile) AppendData (or AddSubdirectory or CreatePipeInstance) WriteEA ReadAttributes WriteAttributes Access Reasons: READ_CONTROL: Granted by Ownership SYNCHRONIZE: Granted by D:(A;;FA;;;SY) WriteData (or AddFile): Granted by D:(A;;FA;;;SY) AppendData (or AddSubdirectory or CreatePipeInstance): Granted by D:(A;;FA;;;SY) WriteEA: Granted by D:(A;;FA;;;SY) ReadAttributes: Granted by D:(A;;FA;;;SY) WriteAttributes: Granted by D:(A;;FA;;;SY) Access Mask: 0x120196 Privileges Used for Access Check: - Restricted SID Count: 0 Regex used and currently Working for Similar Events (4663,4670): blacklist2 = EventCode="(4663|4670)" Message="Account Name:\W+\w+\$" blacklist3 = EventCode="(5447)" Message="Account Name:\s+\S+LOCAL SERVICE" Regex attempted and currently failing for event 4656 blacklist4 = EventCode="(4656)" Message="Account Name:\W+\w+\$" #Results in all 4656 being blacklisted, not just the COMPUTER$ account events whitelist1 = EventCode="(4656)" Message="Account Name:(?!\W+\w+\$)" #Results in 4656 being filtered, and 4670, and 4663 not showing up. Confirmed both 4656 blacklist and whitelist regex pull proper events while in SPL search by using | regex Message= Where do I go from here? ... View more