topic Re: How to exclude notable events from triggering using erex? in Splunk Search

How to exclude notable events from triggering using erex?

mdicenzo — Thu, 04 Aug 2022 15:04:07 GMT

We have notable events for when a user is created on multiple devices. Most of them are expected for when devices are imaged.

I want to use erex to create a suppression for like accounts. They typically have the same beginning and are followed by 2 numbers. Example would ituser23, ituser24, ituser25.

I am using the search below for testing

index=notable source="Endpoint - Anomalous User Account Creation - Rule" | erex user examples="ituser23, ituser24, ituser25"

I am still getting user accounts that are unrelated such as phone or tablet.

When I look at the recommended regex it seems like it is not being granular enough.

Re: How to exclude notable events from triggering using erex?

richgalloway — Thu, 04 Aug 2022 15:09:35 GMT

Skip erex and go directly to the regex command. This query will filter out users with names consisting of "ituser" followed by 2 digits.

index=notable source="Endpoint - Anomalous User Account Creation - Rule" | regex user!="^ituser\d\d$"

Re: How to exclude notable events from triggering using erex?

mdicenzo — Thu, 04 Aug 2022 16:10:14 GMT

This is eventually how I did this. Thank you for the help!

Re: How to exclude notable events from triggering using erex?

richgalloway — Thu, 04 Aug 2022 16:34:48 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.