topic Re: Need to Disable A Process Name with Event ID in Getting Data In

Need to Disable A Process Name with Event ID

anandhalagaras1 — Fri, 04 Sep 2020 07:43:06 GMT

We are collecting Wineventlog data from Security, Application & System.

In Security we want to disable a particular Event Code which is having the corresponding New_Process_Name.

EventCode=4688

New_Process_Message=C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection Manager\\bin\\xxxx.exe

So how can i write the inputs.conf and blacklist the Eventcode with New_Process_Message.

Similarly I have around 30 + New_Process_Message for the EventCode=4688 so how can i blacklist all of them.

Kindly help to provide the inputs.conf for the same.

Re: Need to Disable A Process Name with Event ID

isoutamo — Wed, 02 Sep 2020 13:50:44 GMT

I believe that this posting helps you. https://www.hurricanelabs.com/splunk-tutorials/windows-event-log-filtering-design-in-splunk
r. Ismo

Re: Need to Disable A Process Name with Event ID

anandhalagaras1 — Wed, 02 Sep 2020 14:29:10 GMT

Thanks.

But it would be really helpful if you can provide a inputs config file so that i can check on the same.

Re: Need to Disable A Process Name with Event ID

anandhalagaras1 — Thu, 03 Sep 2020 15:33:20 GMT

Hi All,

I have tried to disable EventCode=4688 with New Process Name filtration but the logs are still getting ingested into Splunk.

@isoutamo @woodcock Hence kindly help on my request.

Here are my inputs.conf

blacklist = EventCode="4688" Message="(?:New Process Name:).+(?:Windows\\System32\\conhost.exe)"
blacklist0 = EventCode="4688" Message="(?:New Process Name:).+(?:SplunkUniversalForwarder\\bin\\splunk-winhostinfo.exe)"
blacklist1 = EventCode="4688" Message="(?:New Process Name:).+(?:Symantec\\Symantec Endpoint Protection Manager\\bin\\USNWash.exe)"
blacklist2 = EventCode="4688" Message="(?:New Process Name:).+(?:Symantec\\Symantec Endpoint Protection Manager\\bin\\XDelta64\\xdelta3.exe)"
blacklist3 = EventCode="4688" Message="(?:New Process Name:).+(?:Symantec\\Symantec Endpoint Protection Manager\\tomcat\\bin\\sempub.exe)"

So kindly help to correct me where is the gap. So that i can update the same for the rest of the "New Process Name".

Re: Need to Disable A Process Name with Event ID

anandhalagaras1 — Thu, 03 Sep 2020 16:15:30 GMT

Can anyone help on my request please.