topic Re: Windows Eventlog Blacklist Failing in Getting Data In

Windows Eventlog Blacklist Failing

pizzor — Wed, 09 Jun 2021 17:20:49 GMT

Having issues with a blacklist of mine. Trying to filter out specific instances of an event code using regex. When I test out the pattern with regexr for example, it matches without issue. But the events are coming in regardless.

My blacklist would be:

blacklist7 = EventCode = "4672" Message = "Account\sName\:\s+ACCOUNTNAME\$"

And an example event would be:

06/09/2021 07:55:08 AM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=4672 EventType=0 Type=Information ComputerName=HOSTNAME TaskCategory=Special Logon OpCode=Info RecordNumber=3400724885 Keywords=Audit Success Message=Special privileges assigned to new logon. Subject: Security ID: NT AUTHORITY\SYSTEM Account Name: ACCOUNTNAME$ ...

Re: Windows Eventlog Blacklist Failing

alemarzu — Wed, 09 Jun 2021 15:52:21 GMT

Hi @pizzor

Trying to filter WinEventLogs with more than EventCodes is limited by some key fields. Its not a free regex that you can drop there sort to speak.

You can find this set of valid keys in here: https://docs.splunk.com/Documentation/Splunk/8.2.0/Admin/Inputsconf#Event_Log_allow_list_and_deny_list_formats

Hope it helps.

Re: Windows Eventlog Blacklist Failing

pizzor — Wed, 09 Jun 2021 16:11:35 GMT

Thanks, but the key I am using (Message) is listed. The "Account Name" piece also does show up in the Message field in the final extract results as well.

Splunk documentation also lists what I am trying to do as a example on this doc, under Example 5:

https://docs.splunk.com/Documentation/Splunk/latest/Data/Whitelistorblacklistspecificincomingdata?r=searchtip

Re: Windows Eventlog Blacklist Failing

richgalloway — Wed, 09 Jun 2021 17:11:51 GMT

Perhaps it is a typo just in the question, but the EventCode value in the blacklist does not match that in the event.

Re: Windows Eventlog Blacklist Failing

pizzor — Wed, 09 Jun 2021 17:17:07 GMT

It is, sorry. I am actually doing the same filter for similar events on both event codes 72 and 27, and got my examples mixed up. I'll correct that.

Re: Windows Eventlog Blacklist Failing

pizzor — Tue, 29 Jun 2021 18:50:17 GMT

Seems I'm just not careful enough and my stanza name had a typo. The blacklist works as intended once I corrected that.