topic Routing windows security logs to another index in Getting Data In

Routing windows security logs to another index

lclayton95 — Mon, 21 Oct 2024 20:33:09 GMT

I am trying to route my windows security logs to another specified index but it has to meet certain criteria.

EventCode has to be 4688 and the Token Elevation Level equals either %%1936, %%1938, TokenElevationTypeDefault, TokenElevationTypeLimited.

So far i have written these regular expressions

1. REGEX = ((?s).*EventCode=4688*.)((?si).*(%%1936|TokenElevationTypeDefault|TokenElevationTypeLimited)*.)

2. REGEX = EventCode=4688.*TokenElevationType=(%%1936|%%1938|TokenElevationTypeDefault|TokenElevationTypeLimited)

When using 1, All eventcodes 4688 come to the specified index when i only wanted 1936 and 1938. I wanted to leave the %%1937 token in its original index.

When using 2, no data at all comes to the index even though its seems to be a much simpler regex. What am i missing to ensure 4688 is properly filter using transforms and props?

Re: Routing windows security logs to another index

marnall — Mon, 21 Oct 2024 20:49:08 GMT

In Regex 1, you seem to have .* backwards (*.) in two instances, where the one near the end is particularly problematic, so if you have:

(%%1936|TokenElevationTypeDefault|TokenElevationTypeLimited)*.

Then it will match strings like %%1936, 0 or more times, so it will match events which don't include %%1936 or the other strings.

Try removing the *. near the end. Also I recommend testing the regex on a site like regex101.com to make sure your regex is working before you put it in your splunk config.

Re: Routing windows security logs to another index

lclayton95 — Mon, 21 Oct 2024 20:56:24 GMT

Yeah i been testing on regex 101 seem to be some delta in how splunk processes the regex however. For example this is what i have so far

https://regex101.com/r/95JbuG/1

but when i add another event to this the regex stops working

Re: Routing windows security logs to another index

marnall — Tue, 22 Oct 2024 19:07:30 GMT

Could you try this regex:

(?s)EventCode=4688.*Token Elevation Type: (%%1936|%%1938|TokenElevationTypeDefault|TokenElevationTypeLimited)

And also post your (sanitized) props.conf and transforms.conf if it does not work?