topic WMI Filter event log security Category string in Getting Data In

WMI Filter event log security Category string

android_74 — Wed, 20 Apr 2011 05:01:40 GMT

Hi,

Running a trial of splunk 4.2 on windows 2008, attempting to filter before entering the index queue. Objective to "account management" security events and drop all other events.

The only data to enter index is

source="WMI:WinEventLog:Security" CategoryString="Account Management"

I have created props.conf and transforms.conf in C:\Program Files\Splunk\etc\system\local tried a few different combinations, but so far no progress.

props.conf

[WinEventLog:Security]

TRANSFORMS-evtlog = wmi-filter,wmi-null`

transforms.conf

[wmi-null]

REGEX = .

DEST_KEY = queue

FORMAT = nullQueue

[wmi-filter]

REGEX=(?msi)^(CategoryString=Account Management)

DEST_KEY = queue

FORMAT = indexQueue

welcome some guidance, thanks

Re: WMI Filter event log security Category string

hazekamp — Wed, 20 Apr 2011 21:10:29 GMT

Android,

The issue could be with props.conf above. If your data is being indexed as WMI:WinEventLog:Security, your <spec> stanza within props.conf should reflect:

## props.conf
[WMI:WinEventLog:Security]
TRANSFORMS-evtlog = wmi-null,wmi-filter

UPDATE: For TRANSFORMS you want to place your catch all as the first property to run.

Re: WMI Filter event log security Category string

android_74 — Thu, 21 Apr 2011 01:38:10 GMT

unfortunately this change has still has not had the desired outcome, all of the eventlog is till coming thru. Thanks for your assistance.

Re: WMI Filter event log security Category string

android_74 — Thu, 21 Apr 2011 01:56:54 GMT

trying out

[source::(?-i)WMI:WinEventLog:Security]

TRANSFORMS-evtlog = wmi-filter,wmi-null

Re: WMI Filter event log security Category string

android_74 — Thu, 21 Apr 2011 05:36:33 GMT

okay... just tried:

props.conf

[WMI:WinEventLog:Security]

TRANSFORMS-evtlog = wmi-null,wmi-filter

and it is working!.. which is very confusing. I did swap the tranforms around, but still.

thank you.

Re: WMI Filter event log security Category string

android_74 — Mon, 28 Sep 2020 09:30:01 GMT

If it helps, this is pretty much my final for auditing changes to active directory

props.conf

[WMI:WinEventLog:Security]

TRANSFORMS-evtlog = wmi-null,wmi-filter,wmi-filter28user,wmi-filter28SecGrp,wmi-filter28DlGrp

transforms.conf

[wmi-null]

REGEX = .

DEST_KEY = queue

FORMAT = nullQueue

[wmi-filter]

REGEX=(?msi)^(CategoryString=Account Management)

DEST_KEY = queue

FORMAT = indexQueue

[wmi-filter28user]

REGEX=(?msi)^(CategoryString=User Account Management)

DEST_KEY = queue

FORMAT = indexQueue

Re: WMI Filter event log security Category string

android_74 — Wed, 27 Apr 2011 00:38:35 GMT

[wmi-filter28SecGrp]

REGEX=(?msi)^(CategoryString=Security Group Management)

DEST_KEY = queue

FORMAT = indexQueue

[wmi-filter28DlGrp]

REGEX=(?msi)^(CategoryString=Distribution Group Management)

DEST_KEY = queue

FORMAT = indexQueue