topic Re: What Windows Event Codes are generally acceptable to filter out? in Getting Data In

What Windows Event Codes are generally acceptable to filter out?

jones4bob — Wed, 12 May 2010 23:15:55 GMT

Is there a good reference list or someone that can post what ways Windows Event Logs are being filtered? I'm particularly interested in those from a security perspective. For example, I get a flood of successful logins on an IIS web server from the IUSR account, which is of little value to me.

Re: What Windows Event Codes are generally acceptable to filter out?

BunnyHop — Thu, 13 May 2010 02:28:05 GMT

You can filter using multiple values or one value.

See this answer for an example: http://answers.splunk.com/questions/577/how-do-you-filter-windows-event-log

I filter out EventCodes that are irrelevant. This site gives you a down and dirty look at WindowsEventLog:

http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/default.aspx

The webinars in the site are pretty helpful as well. Once you've built your list of events to filter, apply them on your splunk instance.

Re: What Windows Event Codes are generally acceptable to filter out?

chaker — Sun, 09 Mar 2014 00:53:58 GMT

Splunk 6 makes this easier now with blacklists for windows inputs.

[WinEventLog:Security]
disabled = false
blacklist = 5156-5157

It also makes suppressing the message payload much easier.

[WinEventLog:Security]
disabled = 0
suppress_text = 1

http://blogs.splunk.com/2013/10/14/windows-event-logs-in-splunk-6/

Re: What Windows Event Codes are generally acceptable to filter out?

denisevw — Mon, 19 May 2014 20:12:49 GMT

This does not work on Universal Forwarders, correct?