Hello all, I would like to exclude the following windows event log on the universal forwarder.       07/15/2020 08:38:55 AM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4103 EventType=4 Type=Information ComputerName=HA-AGM-DB-01.SSI.LOCAL User=NOT_TRANSLATED Sid=S-1-5-21-2993187273-2588912068-3154952105-14529 SidType=0 TaskCategory=Executing Pipeline OpCode=To be used when operation is just executing a method RecordNumber=90748 Keywords=None Message=CommandInvocation(Out-Host): "Out-Host" CommandInvocation(Out-Default): "Out-Default" ParameterBinding(Out-Default): name="Transcript"; value="True" Context: Severity = Informational Host Name = ApmPSHost Host Version = 1.0 Host ID = 85e424db-4fce-46cb-90d4-bace72bb3e2a Host Application = SWJobEngineWorker2.exe 3e167b33-0a26-4f7e-9964-e38b1e939cc6 6612 AgentPlugin SolarWinds.APM.Probes Engine Version = 5.1.14393.3383 Runspace ID = 3c6aab92-96b5-464d-8659-0e81de6d4ec9 Pipeline ID = 1 Command Name = Command Type = Script Script Name = Command Path = Sequence Number = 193 User = xxxxx Connected User = Shell ID = Microsoft.PowerShell User Data:       Tried with this blacklist : blacklist = EventCode="4103" Message="Host\sApplication\s=*SolarWinds.APM.Probes"   ... View more

Hi all, I would like to hide password at payload_printable field in event log from suricata json.eve. {"timestamp":"2019-08-06T15:27:49.017308+0700","flow_id":1987237243921272,"in_iface":"em3","event_type":"alert","vlan":214,"src_ip":"192.168.214.53","src_port":62848,"dest_ip":"192.168.217.135","dest_port":5501,"proto":"TCP","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2012886,"rev":3,"signature":"ET POLICY Http Client Body contains passwd= in cleartext","category":"Potential Corporate Privacy Violation","severity":1},"app_proto":"http","payload_printable":"POST \/ttlbankgw HTTP\/1.1\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol 4.0.30319.42000)\r\nContent-Type: text\/xml; charset=utf-8\r\nSOAPAction: \"\"\r\nHost: xxxxxxxxxxxxxxx\r\nContent-Length: 870\r\nExpect: 100-continue\r\nConnection: Keep-Alive\r\n\r\n<?xml version=\"1.0\" encoding=\"utf-8\"?><soap:Envelope xmlns:soap=\"http:\/\/schemas.xmlsoap.org\/soap\/envelope\/\" xmlns:xsi=\"http:\/\/www.w3.org\/2001\/XMLSchema-instance\" xmlns:xsd=\"http:\/\/www.w3.org\/2001\/XMLSchema\"><soap:Body><messageTransfer xmlns=\"xxxxxxxxxxxxxxx\"><arg0 xmlns=\"\"><msg type=\"deposit\" time=\"1565105192181\" resvr=\"510020190806000539\" appId=\"xxxxxxxxxxxxxxx\" userId=\"xxxxxxxxxxxxxxx\" passwd=\"123456\"......","stream":1} payload_printable: POST /ttlbankgw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol 4.0.30319.42000) Content-Type: text/xml; charset=utf-8 SOAPAction: "" Host: xxxxxxxxxxxxxxx Content-Length: 870 Expect: 100-continue Connection: Keep-Alive <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><messageTransfer xmlns="xxxxxxxxx"><arg0 xmlns=""><msg type="deposit" time="1565105192181" resvr="510020190806000539" appId="XXXXXX" userId="XXXXXX" passwd="123456".......... This is my props.conf: [suricata] KV_MODE = json NO_BINARY_CHECK = 1 TRUNCATE = 0 SEDCMD-pass=s/pass=[^& \t\n]*/pass=\[FILTERED\]/gi SEDCMD-pwd=s/pwd=[^& \t\n]*/pwd=\[FILTERED\]/gi SEDCMD-passwd=s/passwd=[^& \t\n]*/passwd=\[FILTERED\]/gi SEDCMD-password=s/password=[^& \t\n]*/password=\[FILTERED\]/gi I tested my regex with regex10, it worked. But I don't know why it not work in splunk. ... View more