topic Re: WinEventLog:Security filter in Getting Data In

WinEventLog:Security filter

biciunas — Wed, 01 Feb 2012 19:46:16 GMT

I'm running Splunk 4.2.5 server on CentOS. I've also installed SplunkForwarder 4.3 on a Win2k3 server, collecting Application, Security, and System events.

On the server, I have defined

props.conf
[WinEventLog:Security]
TRANSFORMS-set=dropevents

transforms.conf
[dropevents]
REGEX = (?msi)^EventCode=(560|562|567).*^(Type=Audit Success)
DEST_KEY = queue
FORMAT = nullQueue

I've tried various forms of the REGEX, including just the EventCodes, one EventCode, etc. Nothing seems to work; no events are dropped. I read that this was a known issue before 4.2.1, but it is not listed in the 4.3 known issues. Can anyone enlighten me as to what I may be doing wrong?

Re: WinEventLog:Security filter

bojanz — Wed, 01 Feb 2012 22:46:19 GMT

Your regex is incorrect.

It is Type=Success Audit, not Type=Audit Success (this happens with Windows 2008 which have different Event Codes - in which case your Event Codes are incorrect) as you wrote.
Something like this should work:

[dropevents]
REGEX = (?msi)^EventCode=(560|562|567).*^Type=Success Audit
DEST_KEY = queue
FORMAT = nullQueue

Re: WinEventLog:Security filter

biciunas — Thu, 02 Feb 2012 13:38:35 GMT

Thanks for the correction - that was the solution. I guess I need remedial comprehension training, since I was staring at the answer in the logs..

Re: WinEventLog:Security filter

splunkIT — Wed, 11 Sep 2013 22:39:21 GMT

Example for Windows 2008 WinSecurity events:

[dropevents]
REGEX = (?msi)^EventCode=(4776|4648|4624|4634).*^Keywords=Audit\sSuccess
DEST_KEY = queue
FORMAT = nullQueue

You can also use the following site to verify the regex:

http://gskinner.com/RegExr/?31r9a