topic Re: Blacklisting Windows EventCodes in Splunk Search

Blacklisting Windows EventCodes

Bo3432 — Thu, 07 Dec 2023 13:06:43 GMT

I am trying to remove window EventCodes 4688 and 4627. Nothing I have tried has worked. Her are the things that I have tried. This is on the inputs.conf.

blacklist = EventCode="4688" Message="(?:New Process Name:).+(?:SplunkUniversalForwarder\bin\splunk.exe)|.+(?:SplunkUniversalForwarder\bin\splunkd.exe)|.+(?:SplunkUniversalForwarder\bin\btool.exe)|.+(?:Splunk\bin\splunk.exe)|.+(?:Splunk\bin\splunkd.exe)|.+(?:Splunk\bin\btool.exe)|.+(?:Agent\MonitoringHost.exe)" blacklist1= EventCode="4688" blacklist2= EventCode="4627" blacklist= EventCode=4627,4688 blacklist = EventCode=4627|4688 blacklist= EventCode=%^(4627|4688)$% blacklist= EventCode=%^4627$% blacklist= EventCode=%^4688$%

Re: Blacklisting Windows EventCodes

soniya-01 — Thu, 07 Dec 2023 05:54:51 GMT

Event Code Watchlist:
- Think of your computer as a detective, always keeping an eye on what's happening. EventCodes are like clues or signals.
Blacklist = Unwanted Events:
- Blacklisting is saying, "I don't want these specific clues or signals." It's like telling the detective to ignore certain types of information.
Filtering Out Unwanted Stuff:
- Imagine you're sorting through mail. Blacklisting is like throwing away letters from certain senders you don't want to hear from.
Improving Focus:
- By blacklisting EventCodes, you're helping your computer focus on the events that matter and ignoring the ones that don't.
Less Noise, More Clarity:
- It's like reducing background noise so you can hear the important stuff clearly. Blacklisting helps your computer concentrate on significant events.

Re: Blacklisting Windows EventCodes

Bo3432 — Thu, 07 Dec 2023 05:56:55 GMT

I know the purpose of blacklist

Re: Blacklisting Windows EventCodes

PickleRick — Thu, 07 Dec 2023 07:52:55 GMT

You mix two different things. One is blacklisting by eventID

blacklist=4627,4688

blacklist3=4627,4688

(of course it can be blacklist1 all the way to blacklist9).

That should work for any event format.

The other format is filtering based on event's contents (which might also include the EventID field).

And the equivalent would be

blacklist=EventCode=%^(4627|3688)$%

You can of course specify a different delimiter for your regex so it might be for example

blacklist=EventCode=+^(4627|3688)$+

Re: Blacklisting Windows EventCodes

Bo3432 — Thu, 07 Dec 2023 12:16:55 GMT

I've tried both of those. I forgot to put EventCode= in a couple examples