topic Specific Windows Events Only in Security

Specific Windows Events Only

achauhan2098 — Wed, 20 Jan 2021 22:55:26 GMT

Hey All,

Sorry if this has been asked before but I couldnt see the same such post.

I want to include some specific windows logs and exclude all others. From what I can see the below config is including other events too - is this because I have Application and System Stanzas with no whitelists? Or do I need to include a blacklist too within this stanza?

[WinEventLog://Security]

disabled = 0

start_from = oldest

current_only = 0

evt_resolve_ad_obj = 1

checkpointInterval = 5

whitelist = 4776,4720,4723,1102,4624,4726,4625

renderXml=true

Thanks!

Re: Specific Windows Events Only

tscroggins — Thu, 21 Jan 2021 00:42:57 GMT

Hi @achauhan2098,

Your whitelist should work, but if you have other WinEventLog stanzas present and do not want to index their events, do set disabled = 1 in those stanzas. By default, all events in the referenced event log will be indexed.

Re: Specific Windows Events Only

achauhan2098 — Thu, 21 Jan 2021 11:37:26 GMT

Hi @tscroggins

thanks for the reply. I think that was just my understanding of whitelisting. do you know of an easy way to find what windows events would sit in which stanzas? most of the time it will be obvious but for some events they could legitimately sit in either camp.

Thanks!