topic Re: WinEventLog sourcetype do not match when applied in SEDCMD in Getting Data In

WinEventLog sourcetype do not match when applied in SEDCMD

DanAlexander — Wed, 14 Jun 2023 10:14:50 GMT

Hello, community,

I am having a problem understanding why the WinEventLog sourcetype cannot be accepted as other sourcetypes I have worked with.

Is this WinEventLog should be declared as [WinEventLog] in props.conf when using SEDCMD or it should have a different declaration within the square brackets?

Thank you

Re: WinEventLog sourcetype do not match when applied in SEDCMD

richgalloway — Wed, 14 Jun 2023 17:12:28 GMT

The name within brackets in props.conf should be the same name on a sourcetype= line in inputs.conf. Whether that's "WinEventLog" or something else, they need to match.

That said, I know that SEDCMD works with Windows events so there are no restrictions on using it in certain sourcetypes.

Share your props.conf settings and we may be able to be more specific.

Re: WinEventLog sourcetype do not match when applied in SEDCMD

DanAlexander — Wed, 14 Jun 2023 19:10:19 GMT

Hi @richgalloway,

Thanks for the reply.

Here is what I have used in props.conf

WinEventLog]

SEDCMD=s/(.+)(<EventID>\d+</EventID>)(.*)(<Data Name='ParentProcessName'>.+?</Data>)(.*)/\2\4/g

Re: WinEventLog sourcetype do not match when applied in SEDCMD

DanAlexander — Wed, 14 Jun 2023 19:11:38 GMT

Apologies, opening bracket is in place. That was a copy/paste typo.

Re: WinEventLog sourcetype do not match when applied in SEDCMD

richgalloway — Wed, 14 Jun 2023 19:24:17 GMT

Did you run that regular expression through regex101.com? It looks like it needs a lot of escape characters. If the regex is invalid or doesn't match the data then SEDCMD will not work.

Re: WinEventLog sourcetype do not match when applied in SEDCMD

DanAlexander — Wed, 14 Jun 2023 19:39:30 GMT

There is an excerpt from the log:

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid=' XXXXXXXX -4994-a5ba-3e3b0328c30d}'/><EventID>4688</EventID><Version>2</Version><Level>0</Level><Task>13312</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2023-06-13T10:39:41.797279900Z'/><EventRecordID>12536409</EventRecordID><Correlation/><Execution ProcessID='4' ThreadID='15216'/><Channel>Security</Channel><Computer> XXXXXXXX </Computer><Security/></System><EventData><Data Name='SubjectUserSid'>S-1-5-18</Data><Data Name='SubjectUserName'>XXXXXXXX</Data><Data Name='SubjectDomainName'> XXXXXXXX </Data><Data Name='SubjectLogonId'>0 XXXXXXXX 7</Data><Data Name='NewProcessId'>0x2734</Data><Data Name='NewProcessName'>C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe</Data><Data Name='TokenElevationType'>%%1936</Data><Data Name='ProcessId'>0x17d4</Data><Data Name='CommandLine'></Data><Data Name='TargetUserSid'>S-1-0-0</Data><Data Name='TargetUserName'>-</Data><Data Name='TargetDomainName'>-</Data><Data Name='TargetLogonId'>0x0</Data><Data Name='ParentProcessName'>C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</Data><Data Name='MandatoryLabel'>XXXXXXXX -16384</Data></EventData></Event>

Re: WinEventLog sourcetype do not match when applied in SEDCMD

DanAlexander — Wed, 14 Jun 2023 19:42:26 GMT

I need to remove the events from 4688 splunkd related. I do not want to see events coming from clients.

Re: WinEventLog sourcetype do not match when applied in SEDCMD

richgalloway — Wed, 14 Jun 2023 21:01:33 GMT

Did you put this into regex101.com to see if it works with the expression in your SEDCMD? I hope you don't expect me to do that.