Filtering Windows Security Events based on blacklist

jasonheb — Tue, 29 Sep 2020 07:22:13 GMT

Hello
I am using Splunk UF 6.1.4 on my Windows Domain controllers to monitor windows events. I've put in place a working blacklist to filter out a number of events and that works fine. The issue I have is I also want to filter out an EventCode 4776 where the Error_Cdoe is 0x0

**[WinEventLog://Security]
disabled = 0
start_from = oldest
evt_resolve_ad_obj = 1
checkpointInterval = 5
index = soc
ignoreOlderThan = 2d

whitelist = Category=9

blacklist1 = 4624,4634,4658,4656,4690,4661,4662,5136,5137,538,675,540,566,565,562
blacklist2 = EventCode="4776" Error_Code="0x0"**

As I say the blacklist1 list works,

Or should I be setting blacklist2 to
blacklist2 = EventCode="4776" Message="Error Code:*0x0"

Re: Filtering Windows Security Events based on blacklist

jasonheb — Fri, 25 Sep 2015 02:13:25 GMT

Ok sorted it - The Message needs to include the line for the Error Code
In this case I went for simple exact string match which worked fine
blacklist2 = EventCode="4776" Message="Error Code: 0x0"

topic Filtering Windows Security Events based on blacklist in Getting Data In

Filtering Windows Security Events based on blacklist

whitelist = Category=9

Re: Filtering Windows Security Events based on blacklist