Event filtering is not working as expected... what's missing?

cmlombardo — Fri, 13 Feb 2015 14:40:43 GMT

I am pulling my hair off on this one.
I am trying to remove from the windows firewall logs all the IPv6 link local and IPv4 multicast events.
Here are my props and transforms files:

PROPS.CONF

[Windows_Firewall]

TRANSFORMS-7_FilterUselessAddresses = filter_lladdresses, filter_multicast
TRANSFORMS-8_AssignToIndex = windowsfirewall_setindex_default

TRANSFORMS.CONF
[filter_lladdresses]
REGEX = (?i)^(?!.*fe80::).*$
FORMAT = sourcetype::Windows_Firewall
DEST_KEY = MetaData:Sourcetype

[filter_multicast]
REGEX = (?i)^(?!.*224\.0\.0\.).*$
FORMAT = sourcetype::Windows_Firewall
DEST_KEY = MetaData:Sourcetype


[windowsfirewall_setindex_default]
SOURCE_KEY = MetaData:Sourcetype
REGEX = (?i)^sourcetype::Windows_Firewall
DEST_KEY = _MetaData:Index
FORMAT = wf_i

For some reasons which I can't figure out, these events are NOT filtered out.

I need another set of eyes to see what is wrong...

Thank you!

Claudio

Re: Event filtering is not working as expected... what's missing?

cmlombardo — Fri, 13 Feb 2015 15:45:57 GMT

I solved my problem.

I changed transforms.conf this way:

[filter_lladdresses]
REGEX = (?i)^(?=.*fe80::).*$
DEST_KEY = queue
FORMAT = nullQueue

#Removes multicast traffic (224.0.0) stuff.
[filter_multicast]
REGEX = (?i)^(?=.*224\.0\.0\.).*$
DEST_KEY = queue
FORMAT = nullQueue

Now it works just fine.

topic Re: Event filtering is not working as expected... what's missing? in Getting Data In

Event filtering is not working as expected... what's missing?

Re: Event filtering is not working as expected... what's missing?