I was previously using the Seckit template for windows collection given to me by professional services and I noticed that the Splunk*.exe regex they are using was not working with the new xml tags as advertised. This is also in docs as a recommended stanza. [WinEventLog://Security] renderXml = true disabled = false evt_resolve_ad_obj = true blacklist1 = EventCode="4662" Message="Object Type:\s+(?!groupPolicyContainer)" blacklist2 = EventCode="566" Message="Object Type:\s+(?!groupPolicyContainer)" blacklist3 = EventCode="4688" Message="New Process Name: (?i)(?:[C-F]:\Program Files\Splunk(?:UniversalForwarder)?\bin\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi)).exe)" I figured because Message isn't the field that is there anymore so I modified it for the Xml tags and it is still not working [WinEventLog://Security] renderXml = true disabled = false evt_resolve_ad_obj = true blacklist1 = EventCode="4662" Message="Object Type:\s+(?!groupPolicyContainer)" blacklist2 = EventCode="566" Message="Object Type:\s+(?!groupPolicyContainer)" blacklist3 = EventID="4688" NewProcessName=((?i)(?:[C-F]:\\Program Files\\(Splunk|SplunkUniversalForwarder)\\bin\\(?:btool|splunk|splunkd|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi))\.exe) ... View more