Blacklist EventCode=4688 Not working with renderXml=true

[seanjconnell]

I was previously using the Seckit template for windows collection given to me by professional services and I noticed that the Splunk*.exe regex they are using was not working with the new xml tags as advertised. This is also in docs as a recommended stanza.

 [WinEventLog://Security]
     renderXml = true
     disabled = false
     evt_resolve_ad_obj = true
     blacklist1 = EventCode="4662" Message="Object Type:\s+(?!groupPolicyContainer)"
     blacklist2 = EventCode="566" Message="Object Type:\s+(?!groupPolicyContainer)"
     blacklist3 = EventCode="4688" Message="New Process Name: (?i)(?:[C-F]:\Program Files\Splunk(?:UniversalForwarder)?\bin\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi)).exe)"

I figured because Message isn't the field that is there anymore so I modified it for the Xml tags and it is still not working

[WinEventLog://Security]
     renderXml = true
     disabled = false
     evt_resolve_ad_obj = true
     blacklist1 = EventCode="4662" Message="Object Type:\s+(?!groupPolicyContainer)"
     blacklist2 = EventCode="566" Message="Object Type:\s+(?!groupPolicyContainer)"
     blacklist3 = EventID="4688" NewProcessName=((?i)(?:[C-F]:\\Program Files\\(Splunk|SplunkUniversalForwarder)\\bin\\(?:btool|splunk|splunkd|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi))\.exe)

[spayneort · Accepted solution]

Use the $XmlRegex key instead of Message.

Reference: https://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWindowseventlogdata#Use_blacklists_a...

[dstaulcu]

Any idea what version of Splunk Universal forwarder introduced the $xmlRegex option?

[seanjconnell]

blacklist3 = $XmlRegex="<EventID>4688<\/EventID>.*<Data Name='NewProcessName'>[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi))\.exe"

gathered from

https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-blacklist-Windows-Security-Events-in-XML...