topic Re: whitelist windows event logs in Training + Certification Discussions

whitelist windows event logs

splunkbeef — Thu, 03 Jan 2019 20:09:18 GMT

The whitelist is not working for windows event logs. Is there something I'm doing wrong?
I'm trying to exclude event 4625 from blacklist1 because it is logged as information.

[WinEventLog://Security]
disabled=0
whitelist = EventCode="4625"
blacklist1 = Type = "(Information)"
blacklist2 = Type = "(Security Audit Success)"
blacklist3 = EventCode="36888"

Re: whitelist windows event logs

muralikoppula — Thu, 03 Jan 2019 22:26:01 GMT

Check the below answers:
https://answers.splunk.com/answers/235768/not-able-to-whitelist-windows-events-logs.html
https://answers.splunk.com/answers/152131/filter-windows-eventcode-using-blacklist-and-whitelist.html

Re: whitelist windows event logs

splunkbeef — Fri, 04 Jan 2019 14:18:52 GMT

I looked at this documentation and others. Ran various btool options, I have no errors reported with btool check, and regex-validate. The debug output seems pretty clean also.

Re: whitelist windows event logs

ssadh_splunk — Thu, 28 Mar 2019 12:04:32 GMT

If you are trying to exclude the event 4625, then you should not use whitelist.
Whitelist will include the following pattern.

Comments from documentation - https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Inputsconf#Event_Log_whitelist_and_blacklist_formats
" * Example:
whitelist = EventCode=%^200$% User=%jrodman%
Include events only if they have EventCode 200 and relate to User jrodman
"
Just try to use Blacklist if you want to drop EventCode 4625.
Maybe try
blacklist1 = EventCode="4625"
or
blacklist1 = EventCode="4625" Type = "(Information)"