topic Re: WinEventLog Security Regex in Getting Data In

WinEventLog Security Regex

barne_dn — Wed, 10 Oct 2012 20:02:22 GMT

Hi Everyone,

I have windows security event filter setup and working on my indexer. However I want to filter on three variables.

The logic is as follows: Keep all events, except the ones that match the regex.

My current filter looks like this:

[dropevents]
REGEX = (?msi)^EventCode=(123|678|910).*^(User=userxxx)
DEST_KEY = queue
FORMAT = nullQueue

I want to add one more variable to the filter (Type=Success Audit).

Also, in the future I may want to add a hostname to this regex, so that it only filters out these events on a certain host, so once host name is added it would be filtering on 4 variables.

Thanks!

Re: WinEventLog Security Regex

dturnbull_splun — Fri, 12 Oct 2012 22:27:08 GMT

Do you need to filter these independently or dependently? i.e. must we match the eventcode, type and user and host? or is it some combination, i.e eventcode+host or eventcode+user? for the former, just add to your regex, for the later, add multiple stanzas.

Re: WinEventLog Security Regex

barne_dn — Tue, 16 Oct 2012 12:41:42 GMT

What would be syntax for adding to the regex. I've only seen examples of addting two variables to a regex, not three or four.

Re: WinEventLog Security Regex

BP9906 — Mon, 05 Nov 2012 17:01:36 GMT

This works like a charm.

/opt/splunk/etc/system/local/transform.conf

#Exclude Sample User Authentication Events
[nullFilter-user1]
REGEX=(?ism)EventCode\s*=\s*(123|456|789).*User\s*=\s*user
DEST_KEY=queue
FORMAT=nullQueue

/opt/splunk/etc/system/local/props.conf

[source::WinEventLog:Security]
TRANSFORMS-nullQ=nullFilter-user1

I do this to filter out all sorts of things. 🙂
Enjoy.