topic Re: WinEvent whitelist not working in Getting Data In

WinEvent whitelist not working

SoknySplunk — Thu, 30 Jan 2020 02:54:42 GMT

I'm trying to do whitelist on windows eventcode on my test environment before applying on production. after apply and reload, there no log activity come to splunk.

[WinEventLog://Security]
disabled = 0
whitelist1 = 4624,4625,4634,4688,4689,4720,4722-4726,4728,4729,4732,4756,4778,4779
whitelist2 = EventCode="5156" Message="(putty.exe)|(SecureCRT.exe)|(mstsc.exe)|(winscp.exe)"

Thanks in advance your help

Re: WinEvent whitelist not working

nickhills — Thu, 30 Jan 2020 19:09:55 GMT

Do you mean you have no WinEventLogs (at all) or just you dont see events for 5156?

Re: WinEvent whitelist not working

SoknySplunk — Fri, 31 Jan 2020 01:43:47 GMT

all events

Re: WinEvent whitelist not working

jbrocks — Sat, 01 Feb 2020 17:51:17 GMT

Not pretty sure how to understand this, but:

* Both numbered and unnumbered whitelists and blacklists support two formats: * A comma-separated list of event IDs. * A list of key=regular expression pairs. * You cannot combine these formats. You can use either format on a specific line.

Seems that you might need to transform your whitelist1 one to key=regex format ... but might also mean that you only can not combine list and key=regex format

Re: WinEvent whitelist not working

vsai0718 — Wed, 12 Feb 2020 22:10:56 GMT

Even we had the same issue, but once we had a monitor stanza for the Security.evtx path in inputs.conf. The logs started coming in for the events that you've whitelisted.