topic Re: How to troubleshoot the applied regex in the server in Deployment Architecture

How to troubleshoot the applied regex in the server

AL3Z — Mon, 25 Sep 2023 08:05:08 GMT

Hi,

I had blacklisted the "(?:ParentProcessName).+(?:C:\\Program Files\\Windows Defender Advanced Threat Protection\\)" in deployment server and applied it to one of the windows server how we can trouble shoot whether it is applied or not ?

Re: How to troubleshoot the applied regex in the server

gcusello — Mon, 25 Sep 2023 08:10:41 GMT

Hi @AL3Z ,

run a search on the index where are stored the logs you filtered and, if your filter is applied on one or more hosts, eventually adding a filter on hosts.

In the search use the same regex using the regex command (https://docs.splunk.com/Documentation/Splunk/9.1.1/SearchReference/Regex).

Something like this:

index=windows host=<your_host> | regex "(?:ParentProcessName).+(?:C:\\Program Files\\Windows Defender Advanced Threat Protection\\)"

Check the results and see if they arrive from the hosts you're waiting or not.

Ciao.

Giuseppe

Re: How to troubleshoot the applied regex in the server

AL3Z — Tue, 26 Sep 2023 16:37:09 GMT

@gcusello ,

Error in 'SearchOperator:regex': The regex '(?:ParentProcessName).+(?:C:\Program Files\Windows Defender Advanced Threat Protection\)' is invalid. Regex: unknown property after \P or \p.

Re: How to troubleshoot the applied regex in the server

gcusello — Mon, 25 Sep 2023 10:52:22 GMT

Hi @AL3Z,

as I said, seanch on the index where are stored the data that you filtered and on the hosts where the rule is applied:

if you haven't events with the used regex, the regex is correct, otherwise you have to troubleshoot it using the same search.

ciao.

Giuseppe

Re: How to troubleshoot the applied regex in the server

AL3Z — Mon, 25 Sep 2023 12:56:59 GMT

@gcusello

How to troubleshoot changes to the inputs.conf ./etc/deployment-apps/windows_test/local/ on the deployment server not reflecting on the host C:\Program Files\SplunkUniversalForwarder\etc\apps\windows_test\local\inputs.conf.

Re: How to troubleshoot the applied regex in the server

gcusello — Mon, 25 Sep 2023 12:42:10 GMT

Hi @AL3Z,

as I said, identify the correct regex using SPL and use that regex to blacklist events in inputs.conf.

Ciao.

Giuseppe

Re: How to troubleshoot the applied regex in the server

AL3Z — Mon, 25 Sep 2023 14:12:54 GMT

@gcusello
Pls help in excluding these 3 paths using single regex ?
C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe
C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe

Re: How to troubleshoot the applied regex in the server

gcusello — Mon, 25 Sep 2023 15:01:19 GMT

Hi @AL3Z,

please try this regex:

C:\\Program Files\\Windows Defender Advanced Threat Protection\\(MsSense|SenseCM|SenseIR)\.exe

if it doesn't run , please try:

C:\\\Program Files\\\Windows Defender Advanced Threat Protection\\\(MsSense|SenseCM|SenseIR)\.exe

Something there's an issue with backslashes.

Ciao.

Giuseppe

Re: How to troubleshoot the applied regex in the server

AL3Z — Mon, 25 Sep 2023 15:24:41 GMT

Do we need to put this inside double quotes?

Blacklist1= message="C:\\Program Files\\Windows Defender Advanced Threat Protection\\(MsSense|SenseCM|SenseIR)\.exe"

Re: How to troubleshoot the applied regex in the server

gcusello — Mon, 25 Sep 2023 15:36:20 GMT

Hi @AL3Z ,

please try:

Blacklist1= message="C:\\Program Files\\Windows Defender Advanced Threat Protection\\(MsSense|SenseCM|SenseIR)\.exe"

Blacklist1 = C:\\Program\sFiles\\Windows\sDefender\sAdvanced\sThreat\sProtection\\(MsSense|SenseCM|SenseIR)\.exe

Ciao.

Giuseppe

Re: How to troubleshoot the applied regex in the server

AL3Z — Tue, 26 Sep 2023 07:30:17 GMT

hi @gcusello What could be the reason still I can see the blacklisted path events but the count is reduced !!

Re: How to troubleshoot the applied regex in the server

gcusello — Tue, 26 Sep 2023 07:47:20 GMT

Hi @AL3Z,

this means that the regex is working only on a subset of the data to filter, in other words there are different format logs.

Analize the not matching data and modify the regex or apply another one.

Ciao.

Giuseppe

Re: How to troubleshoot the applied regex in the server

AL3Z — Tue, 26 Sep 2023 10:14:05 GMT

@gcusello ,

The changes made on the DS app inputs.conf are not reflecting on the host splunk forwarder etc apps local inputs.conf file , in this case can we paste regex in this app inputs.conf so that it can work ??

Re: How to troubleshoot the applied regex in the server

gcusello — Tue, 26 Sep 2023 10:44:36 GMT

Hi @AL3Z,

if the target server is managed by the DS, you cannot manually change a conf file, check why the new configuration isn't pushed.

Ciao.

Giuseppe

Re: How to troubleshoot the applied regex in the server

AL3Z — Fri, 29 Sep 2023 09:55:39 GMT

Hi
@gcusello

I'm trying to blacklist the below paths ..

C:\Program Files\Rapid7\Insight Agent\components\insight_agent\3.2.5.31\ir_agent.exe

C:\Program Files\WindowsPowerShell\Modules\gytpol\Client\fw4_6_2\GytpolClientFW4_6_2.exe

Can we use like.* in place of version if it gets new version it can also be blacklisted ??

---- Rapid7\\Insight Agent\\components\\insight_agent\\.*\\ir_agent.exe)|WindowsPowerShell\\Modules\\gytpol\\Client\\fw.*\\GytpolClientFW.*.exe)

Thanks

Re: How to troubleshoot the applied regex in the server

gcusello — Fri, 29 Sep 2023 10:15:25 GMT

Hi @AL3Z,

modify the regex in Search and see if the new regex matches all the events to filter.

Ciao.

Giuseppe

Re: How to troubleshoot the applied regex in the server

AL3Z — Tue, 21 Nov 2023 11:38:51 GMT

@gcusello ,

I want to blacklist C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe of creatorprocessname would it block the newprocessname of C:\Windows\System32\cmd.exe as well ?

Thanks

Re: How to troubleshoot the applied regex in the server

gcusello — Tue, 21 Nov 2023 14:59:20 GMT

Hi @AL3Z ,

as I said, does your regex match the string to search or not?

if matches it's correct, if not, it isn't!

Ciao.

Giuseppe