topic Re: Prevent ingestion of "NT AUTHORITY\SYSTEM" EventCode 4663 in Getting Data In

Prevent ingestion of "NT AUTHORITY\SYSTEM" EventCode 4663

sswigart — Wed, 17 Jul 2024 14:11:58 GMT

I am exceeding my 5GB license. I have determine the problem by doing a 24 hour search using the following:

index="winlogs" host=filesvr souce="WinEventLog:Security" EventCode=4663 Accesses="ReadData (or ListDirectory) Security_ID="NT AUTHORITY\SYSTEM"

The above search returns 4.5 million plus records.

My question is how do I stop Splunk from ingesting Security_ID="NT AUTHORITY\SYSTEM" of EventCode 4663?

Would appreciate any assistance\suggestions given.

Re: Prevent ingestion of "NT AUTHORITY\SYSTEM" EventCode 4663

gcusello — Thu, 18 Jul 2024 06:12:53 GMT

Hi @sswigart ,

as you can read at https://docs.splunk.com/Documentation/Splunk/9.2.2/Admin/Inputsconf#Event_Log_filtering,

if the logs you indicated aren't relevant for your searches, you can follow the instructons in the above link, adding a blacklist to your inputs.conf in the WinEventLog:Security stanza.

Only one attention point: in the blacklist you must use a regex, not a string to search.

Ciao.

Giuseppe

Re: Prevent ingestion of "NT AUTHORITY\SYSTEM" EventCode 4663

PickleRick — Thu, 18 Jul 2024 12:48:31 GMT

Actually, you can blacklist by eventcodes or by regex. (and with a caveat that if you use renderXml=true, you have to specify blacklist differently).