topic Re: Mupltiple whitelist in inputs.conf in Getting Data In

Mupltiple whitelist in inputs.conf

marco_massari11 — Fri, 03 May 2024 12:56:04 GMT

Hello,

I need to monitor two different types of events for some servers, the authentication events (4624,4634,4625) for the admin users and some Event ID related to change events (5145,4663,4659) for a specific path. Baiscally I created a server class for the inputs.conf deployment, adding this:

###### OS Logs ######

[WinEventLog://Security]

disabled = 0

index = windows_tmp

followTail=true

start_from = oldest

current_only = 0

evt_resolve_ad_obj = 1

checkpointInterval = 5

renderXml=false

I already tested the regex in regex101 https://regex101.com/r/LIaMnU/1 and it seems working fine, but in Splunk I'm receiving all the events as the whitelist is not applied. Am I missing something?

Re: Mupltiple whitelist in inputs.conf

gcusello — Fri, 03 May 2024 13:37:19 GMT

Hi @marco_massari11,

at a first sight the regex isn't correct, what does it happen if you try to use it in search using the regex command?

Ciao.

Giuseppe

Re: Mupltiple whitelist in inputs.conf

marco_massari11 — Fri, 03 May 2024 14:48:54 GMT

Hello @gcusello ,

you're right, in Splunk I have the following error "The regex '((EventCode=(4624|4634|4625)\X*Account Name:(\s+.*\.adm.*))|(EventCode=(4659|4663|5145)\X*Object Name:(\s+.*Test_share.*)))' does not extract anything. It should specify at least one named group. Format: (?<name>...)". I tried also to split the regex in two separated whitelist, but I think they are in AND, so it's not working. Have you some solution?

Regards,

Marco

Re: Mupltiple whitelist in inputs.conf

gcusello — Fri, 03 May 2024 14:54:58 GMT

Hi @marco_massari11 ,

identify the three regexes and collect them using .*

Ciao.

Giuseppe

Re: Mupltiple whitelist in inputs.conf

richgalloway — Fri, 03 May 2024 16:26:23 GMT

The whitelist value must be a list of event IDs or one or more key=regex expressions. The current value is just a regular expression, which is not supported.

Re: Mupltiple whitelist in inputs.conf

marco_massari11 — Fri, 03 May 2024 17:31:48 GMT

Hello @richgalloway ,

have you any possible solution?

Re: Mupltiple whitelist in inputs.conf

richgalloway — Sat, 04 May 2024 12:10:32 GMT

I don't really have a solution. I was going to suggest multiple white lists, but you said that didn't work for you.

Also, you want to filter on AccountName and ObjectName, but those fields are not supported by whitelist/blacklist. See https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Inputsconf#Event_Log_allow_list_and_deny_list_formats for the list of supported fields.

Consider ingesting the Windows events in XML format and filtering them using the $XmlRegex key. See https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/MonitorWindowseventlogdata#Use_allow_lists_and_deny_lists_to_filter_on_XML-based_events for more information.

Re: Mupltiple whitelist in inputs.conf

PickleRick — Sun, 05 May 2024 14:54:53 GMT

As @richgalloway already pointed out - the format is wrong. You need the key=regex format. And you need to split it into separate whitelist entries (each entry can have multiple key=regex parameters).

The trick here is that Account Name is not a field within the event but a field in the Message field of the event. So you need to match it as a regex within the Message field.

So you'd effectively end up with something like

whitelist1 = EventCode=%(4624|4634|4625)% Message=%Account Name:.*\.adm%
whitelist2 = EventCode=%(4659|4663|5145)% Message=%Object Name:.*Test_share%

Re: Mupltiple whitelist in inputs.conf

gcusello — Mon, 06 May 2024 08:56:31 GMT

Hi @marco_massari11 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉