topic Re: Blacklisting EventCode=5156 with Source_Port=8 in Getting Data In

Blacklisting EventCode=5156 with Source_Port=8

nathanpyun — Fri, 09 Oct 2015 13:34:25 GMT

I am trying to blacklist Windows Security event ID 5156 with source port number 8, but does not seem working. Could anyone help me with this? Thank you in advance.

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist1 = EventCode="4662" Message="Object Type:\s+(?!groupPolicyContainer)"
blacklist2 = EventCode="566" Message="Object Type:\s+(?!groupPolicyContainer)"
blacklist3 = EventCode="5156" Source_Port=8
index = wineventlog
renderXml=false

Re: Blacklisting EventCode=5156 with Source_Port=8

asimagu — Fri, 09 Oct 2015 13:58:55 GMT

did you try escaping the double quotes ?

Re: Blacklisting EventCode=5156 with Source_Port=8

nathanpyun — Fri, 09 Oct 2015 20:07:41 GMT

I tried by doing:

blacklist3 = EventCode=5156 Source_Port=8

blacklist3 = EventCode="5156 Source_Port=8"

blacklist3 = EventCode=""5156" Source_Port="8""

but none worked...

Re: Blacklisting EventCode=5156 with Source_Port=8

asimagu — Mon, 12 Oct 2015 08:15:44 GMT

in Splunk you usually escape characters with \, so if you want to escape a double quote you would type \"

Re: Blacklisting EventCode=5156 with Source_Port=8

asimagu — Thu, 15 Oct 2015 08:11:53 GMT

sorry, I just realised that this website escaped my escaping character.
I wanted to say that in Splunk you usually escape characters with a backslash before the character EventCode=\"4662\"

Re: Blacklisting EventCode=5156 with Source_Port=8

shawngarrettsgp — Thu, 26 May 2016 13:56:15 GMT

I'm struggling with a similar issue too, for me it seems to just be flatout blacklisting every 5156 EventCode at this point despite my 2nd regex criteria. I've tried both ways below.

blacklist = EventCode="5156" Destination_Address="172\.(20|21)\.3\.(57|58|59|9)"

blacklist = EventCode="5156" Message="Destination\ Address\:\ 172\.(20|21)\.3\.(57|58|59|9)"

Re: Blacklisting EventCode=5156 with Source_Port=8

shawngarrettsgp — Thu, 26 May 2016 17:55:52 GMT

I think my issue is that my UF's are still prior 6.1 😐 :'(
http://blogs.splunk.com/2014/05/23/controlling-4662-messages-in-the-windows-security-event-log/

Re: Blacklisting EventCode=5156 with Source_Port=8

lakromani — Wed, 10 Apr 2019 06:02:27 GMT

Source_port is not a valid key to use in blacklist

Taken from the manual:
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf?utm_source=answers&utm_medium=in-answer&utm_term=inputs.conf&utm_campaign=refdoc

Valid keys for the key=regex format:

The following keys are equivalent to the fields that appear in the text of the acquired events:
- Category, CategoryString, ComputerName, EventCode, EventType, Keywords, LogName, Message, OpCode, RecordNumber, Sid, SidType, SourceName, TaskCategory, Type, User