topic Re: How to blacklist events for a specific event code and task category? in Getting Data In

How to blacklist events for a specific event code and task category?

nmohammed — Fri, 13 Jul 2018 18:52:47 GMT

Trying to blacklist specific windows event logs based on event code and task category, but doesn't work .

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index = winevents
renderXml=false
blacklist1=EventCode="5145" TaskCategory="(Detailed File Share|File Share)"

Example event - 

07/13/2018 11:22:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5140
EventType=0
Type=Information
ComputerName=SomeServer
TaskCategory=File Share
OpCode=Info
RecordNumber=5487448804
Keywords=Audit Success
Message=A network share object was accessed.

Subject:
    Security ID:        S-1-5-21-xxxxxxxxx-xxxxxx-xxxxxx-xxxx
    Account Name:       cz9_rmc_s3_CIFS$
    Account Domain:     domain
    Logon ID:       0x3D9AC95C1

Network Information:    
    Object Type:        File
    Source Address:     10.xxx.xx.xxx
    Source Port:        45088

Share Information:
    Share Name:     \\*\IPC$
    Share Path:     

Access Request Information:
    Access Mask:        0x1
    Accesses:       ReadData (or ListDirectory)

Re: How to blacklist events for a specific event code and task category?

CarsonZa — Fri, 13 Jul 2018 18:59:34 GMT

try this

blacklist=EventCode=%^5145$% TaskCategory=%(Detailed File Share|File Share)%

Re: How to blacklist events for a specific event code and task category?

somesoni2 — Fri, 13 Jul 2018 19:11:42 GMT

Try using just blacklist instead of blacklist1. You can have upto 10 blacklist filters applied but it should start with blacklist, blacklist1, blacklist2...etc till blacklist9.

Re: How to blacklist events for a specific event code and task category?

nmohammed — Tue, 29 Sep 2020 20:26:42 GMT

Tried this -

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index = winevents
renderXml=false
blacklist1=EventCode="5145" TaskCategory="Detailed File Share"
blacklist1=EventCode="5145" TaskCategory="File Share"

Did not work. Still see the events come in.

Re: How to blacklist events for a specific event code and task category?

nmohammed — Fri, 13 Jul 2018 22:37:18 GMT

Thanks , I tried it as well.. Did not work , still see the events come in.

Re: How to blacklist events for a specific event code and task category?

nmohammed — Fri, 13 Jul 2018 23:33:16 GMT

Actually this worked. I had two different EventCodes sending the Same Category.

Thanks @CarsonZa

Re: How to blacklist events for a specific event code and task category?

gurulee — Fri, 07 Aug 2020 21:17:06 GMT

Thank you for sharing. I found this helpful.