topic Re: Filter Windows EventCode using blacklist and Whitelist in Getting Data In

Filter Windows EventCode using blacklist and Whitelist

sat94541 — Fri, 22 Aug 2014 06:40:47 GMT

I have installed Splunk Universal Forwarder Version 6.1.1 and Indexer also on 6.1.1. I am trying to understand the various option to filter EventCode with these version of Splunk. I think Splunk has introduced some new capability to have whitelist and black list in the Universal Forwarder input stanza .

Re: Filter Windows EventCode using blacklist and Whitelist

rbal_splunk — Mon, 28 Sep 2020 17:22:57 GMT

I have test using Splunk Universal Forwarder Version 6.1.1 and Splunk Indexer 6.1.1.

Test 1: On the Universal Forwarder added whitelist1 and only these EventCode got forwarded to Indexer.

[WinEventLog://Security]
whitelist1 = 5058,5061

Refer : http://docs.splunk.com/Documentation/Splunk/6.1.1/Admin/Inputsconf and 9 whitelist can be specified.

Test 2: On the Universal Forwarder added blacklist1 and all the Eventcode blacklisted were filtered.

[WinEventLog://Security]
disabled = 0
evt_resolve_ad_obj = 0
blacklist1 = 1100,1101,4608,4616,4624,4634,4647,4648,4672,4731,4732,4733,4735,4902,4904,4905,4907,5024,5033,5038,5056,5058,5061

Refer : http://docs.splunk.com/Documentation/Splunk/6.1.1/Admin/Inputsconf and 9 blacklist1 can be specified..

Test 3: The old tradition approach(Prior 6.1.1) still works worked where all the events on the Universal Forwarder are ingested and nullqueue filters is applied on Indexer to filter.

For example :

1)Add the following stanza to props.conf on indexer

[WinEventLog:Security]
TRANSFORMS-set = delete

All the EvnetCode listed were filtered and not indexed.

Re: Filter Windows EventCode using blacklist and Whitelist

wcolgate_splunk — Fri, 22 Aug 2014 17:42:32 GMT

In 6.0 one could filter on just the event code on windows event log modular input. In 6.1 Splunk introduced a regular expression filtering capability. A good blog post can be found here: http://blogs.splunk.com/2014/05/23/controlling-4662-messages-in-the-windows-security-event-log/

Re: Filter Windows EventCode using blacklist and Whitelist

rbal_splunk — Fri, 16 Jan 2015 06:48:22 GMT

Here are some examples based on my test with Universal Forwarder -VERSION=6.1.3 and Index 6.2.1

** Test 1: Data For EventCode=4672 NOT Filtered**

[WinEventLog://Security]
disabled = 0
blacklist1=EventCode=4672

Test 2: The EventCode 4672 was filtered out

[WinEventLog://Security]
disabled = 0
blacklist1=EventCode=”4672”

** Test 3: Filter events code 4672 with any message:**

[WinEventLog://Security]
disabled = 0
blacklist1=EventCode=”4672” Message="*"

Test 4: Another example to see if it will Filter events code 4672 with any message

[WinEventLog://Security]
disabled = 0
blacklist1=EventCode=4672 Message="*"

Result :: Data NOT Filtered

Test 5: In the example below Eventcode 4672 with Message starting with “Special” got filtered.

[WinEventLog://Security]
disabled = 0
blacklist1=EventCode="4672" Message="Special*" >>>>> Data Filtered

Test 6: Here EventCode 4672 with Message starting with “Special” got filtered. In addition all event for code 4624 an 4648 also got filtered.

[WinEventLog://Security]
disabled = 0
blacklist1= EventCode="4672" Message="Special*"
blacklist2= 4624,4648

Re: Filter Windows EventCode using blacklist and Whitelist

rbal_splunk — Fri, 06 Feb 2015 23:26:04 GMT

I needed to filter event code like the shown below where (Process Name: C:\Windows\System32\services.exe)

Subject:
    Security ID:        SYSTEM
    Account Name:       RBAL-T430S$
    Account Domain:     SPLUNK
    Logon ID:       0x3e7

Logon Type:         5

New Logon:
    Security ID:        SYSTEM
    Account Name:       SYSTEM
    Account Domain:     NT AUTHORITY
    Logon ID:       0x3e7
    Logon GUID:     {00000000-0000-0000-0000-000000000000}

Process Information:
    Process ID:     0x314
    Process Name:       C:\Windows\System32\services.exe

Network Information:
    Workstation Name:   
    Source Network Address: -
    Source Port:        -

Detailed Authentication Information:
    Logon Process:      Advapi  
    Authentication Package: Negotiate
    Transited Services: -
    Package Name (NTLM only):   -
    Key Length:     0

The following filter was used in inputs.conf of the forwarder and thsos worked well for me.

---UP ---
input has
[WinEventLog://Security]
blacklist1= Message="Process Name:\s+.*services.exe"

Re: Filter Windows EventCode using blacklist and Whitelist

rbal_splunk — Fri, 04 Sep 2015 21:09:07 GMT

Also tested

I just test this in my environment.
I have Windows Event Code = with details like following
An account was successfully logged on.

Subject:
    Security ID:        SYSTEM
    Account Name:       RBAL-W540$
    Account Domain:     SPLUNK
    Logon ID:       0x3e7
Logon Type:         7
New Logon:
    Security ID:        SPLUNK\rbal
    Account Name:       rbal
    Account Domain:     SPLUNK
    Logon ID:       0x89edb5c5
    Logon GUID:     {3d3aefbf-9375-dbcc-f004-cce3f3ddbbd3}
Process Information:
    Process ID:     0x358
    Process Name:       C:\Windows\System32\lsass.exe
Network Information:
    Workstation Name:   RBAL-W540
    Source Network Address: -

To filter such event I ad to add blacklist like
---------$SPLUNk_HOME/etc/system/local/inputs.conf----------
[WinEventLog://Security]
blacklist1=EventCode="4624" Message="Workstation Name:\s+.RBAL."

Note the “(quote) around the message and another around EventCode to be filteres.
In addition – I checked the regex that I wrote for Messages using -- http://regexr.com/v1/
And another thing to check will to ensure that blacklist to inputs need to be added – where data is ingested from.

Another thing to Watch out for is > if data is ingested on Universal Forwarder you need to add blacklist to input stanza on Splunk Universal Forwarder.
If the Data directly ingested from indexer in that case input with blacklist will go to indexer.

Re: Filter Windows EventCode using blacklist and Whitelist

vsingla1 — Tue, 29 Sep 2020 08:41:47 GMT

I am trying to configure blacklist on my windows events similar to the Scenario that you have put in "Test 5" above.
Your blacklist:
[WinEventLog://Security]
disabled = 0
blacklist1=EventCode="4672" Message="Special*" >>>>> Data Filtered

My Blacklist:
[WinEventLog://Security]
disabled = 0
blacklist1=EventCode="4776" Message="0x0"

My Sample data is as below:
Event to be filtered:
02/04/201604:55:19 AM LogName=SecuritySourceName=Microsoft Windows security auditing. EventCode=4776EventType=0 Type=Information ComputerName=computer1 TaskCategory=Credential Validation OpCode=Info RecordNumber=18834479Keywords=Audit Success Message=The computer attemptedto validate thecredentials for anaccount. Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon Account: SPFARM Source Workstation: WCHWPF464Error Code: 0x0

Event not to be filtered:
02/04/201604:55:19 AM LogName=SecuritySourceName=Microsoft Windows security auditing. EventCode=4776EventType=0 Type=Information ComputerName=computer2 TaskCategory=Credential Validation OpCode=Info RecordNumber=18304483Keywords=Audit Failure Message=The computer attemptedto validate thecredentials for anaccount. Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon Account: Source Workstation: Error Code: 0xc0000064

But following the example in "Test 5" use case, my filter does not work and instead it blacklists the entire events under EventCode=4776. Do you have any thoughts on this?

Re: Filter Windows EventCode using blacklist and Whitelist

Michael — Wed, 05 Apr 2017 16:04:56 GMT

FWIW, I tested multiple versions of all this, to no avail. I even read a Splunk blog that's often cited by similar questions... I love it when you read "accepted answers" for your questions, and docs, and blogs, and NONE of what they say work until you experiment on your own and stumble upon a solution, happens more times than I want to admit.

Here's what finally worked for me (your mileage may vary):

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist1 = EventCode="5156" Message="*"

Using a deployment server (6.5.1) and Universal Forwarders (6.5.1.). Don't know if all that other cruft is necessary, but it works for me. Oh, and make sure you don't have more than one [WinEventLog://Security] stanza.

Re: Filter Windows EventCode using blacklist and Whitelist

nychawk — Mon, 22 Jan 2018 23:05:01 GMT

Hello;

I am already collecting and forwarding all logs from my servers into WEC, WEC then whitelisting and resending into Splunk only the Security Events ID's I am interested in.

I would like to additionally resend into Splunk a "whitelisted" "System" logs, but only for "error" and "critical"; i.e., not EventID based as I am not sure what they are, plus do not wish to index informational garbage.

Does anyone know how to white-list based on level vs. ID?

Thank you in advance,

-mi