https://community.splunk.com/t5/Getting-Data-In/WinEventLog-WhiteList-4662/m-p/549367#M91271 <P>An interesting turn of events..</P><P>It looks like the events ARE being indexed..</P><P>but instead of Object Type: computer, Object Name: hostname, they are coming in as:</P><LI-CODE lang="markup">Object: Object Server: DS Object Type: %{bf967a86-0de6-11d0-a285-00aa003049e2} Object Name: %{fbdc83b5-af6f-4dd2-8256-458e8e1348e2} Handle ID: 0x0</LI-CODE><P>&nbsp;</P><P>Not sure why...<BR />In the local event viewer, it is resolving the GUID</P> Mon, 26 Apr 2021 19:07:55 GMT richardphung 2021-04-26T19:07:55Z https://community.splunk.com/t5/Getting-Data-In/WinEventLog-WhiteList-4662/m-p/549362#M91269 <P>Greetings--</P><P>I am trying to set-up an WinEventLog inputs.conf whitelist for LAPS (EventCode=4662).<BR /><BR />These events have a similar structure in so far as:</P><P>&nbsp;</P><LI-CODE lang="markup">Object: Object Server: DS Object Type: computer Object Name: CN=hostname</LI-CODE><P>&nbsp;</P><P><BR /><BR />Which looks something like...</P><P>&nbsp;</P><LI-CODE lang="markup">[WinEventLog://Security] disabled = 0 index = wineventlog checkpointInterval = 5 blacklist1 = EventCode="4660" Message="Process Name:\s+(?i)(?:[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|optimizer|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi))\.exe)" blacklist2 = EventCode="4662" Message="Object Type:\s+(?!groupPolicyContainer)" blacklist3 = EventCode="4663" Message="Process Name:\s+(?i)(?:[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|optimizer|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi))\.exe)" blacklist4 = EventCode="566" Message="Object Type:\s+(?!groupPolicyContainer)" blacklist5 = EventCode="4688" Message="New Process Name: (?i)(?:[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|optimizer|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi))\.exe)" whitelist = EventCode="4662" Message\="Object Type:(.*)computer([\s\S]*)Object Name:(.*)CN="</LI-CODE><P>&nbsp;</P><P><BR />This seems to block all EventCode=4662</P><P>I have tried to do something to the effect of:</P><P>&nbsp;</P><LI-CODE lang="markup">EventCode=%^4662$%</LI-CODE><P>&nbsp;</P><P>Per&nbsp;<A href="https://community.splunk.com/t5/Getting-Data-In/inputs-conf-Windows-event-whitelist/m-p/502836#M85657" target="_blank" rel="noopener">https://community.splunk.com/t5/Getting-Data-In/inputs-conf-Windows-event-whitelist/m-p/502836#M85657</A></P> Mon, 26 Apr 2021 17:31:43 GMT https://community.splunk.com/t5/Getting-Data-In/WinEventLog-WhiteList-4662/m-p/549362#M91269 richardphung 2021-04-26T17:31:43Z https://community.splunk.com/t5/Getting-Data-In/WinEventLog-WhiteList-4662/m-p/549367#M91271 <P>An interesting turn of events..</P><P>It looks like the events ARE being indexed..</P><P>but instead of Object Type: computer, Object Name: hostname, they are coming in as:</P><LI-CODE lang="markup">Object: Object Server: DS Object Type: %{bf967a86-0de6-11d0-a285-00aa003049e2} Object Name: %{fbdc83b5-af6f-4dd2-8256-458e8e1348e2} Handle ID: 0x0</LI-CODE><P>&nbsp;</P><P>Not sure why...<BR />In the local event viewer, it is resolving the GUID</P> Mon, 26 Apr 2021 19:07:55 GMT https://community.splunk.com/t5/Getting-Data-In/WinEventLog-WhiteList-4662/m-p/549367#M91271 richardphung 2021-04-26T19:07:55Z