Windows Process Name inputs.conf Blacklisting Regex Help

[zward]

I am in desperate need of some help on regex/blacklisting process names in Windows Event logs. Our regex to exclude / filter out specific Process Name executables is not working and I would guess it likely is due to improper regex. I could definitely use any advice or help on the below regex as I am by no means an expert, but have done my best to try and get it working, but I just can't seem to get it. Right now the 4663 processes are completely overwhelming our licensing due to the amount of events being generated.

Here is our regex code that is not functioning (blacklist8). Below that is our full blacklist. This is being done via Windows_TA inputs.conf file within the local directory being deployed to all universal forwarders. I am trying to exclude any message received by Windows that shows Process Name as one of the executables.
Thank you so much for your help!

Line that is not working:

blacklist8 = EventCode="(4660|4663|4688|4689)" Message="Process Name:\s+*Tei.Content.ContentPublisher.exe|*BBL.exe|*BESRootServer.exe|*BESClient.exe|*elasticsearch-service-x64.exe|*bactalk.exe|*mcshield.exe|*splunk-optimize.exe|*splunk-winevtlog.exe|*bactalk.exe|*w3wp.exe|*Microsoft.Exchange.Diagnostics.Service.exe|*MSExchangeHMWorker.exe|*SearchProtocolHost.exe|*SearchIndexer.exe|*PSMONITORSRV.exe|*nslookup.exe|*traceroute.exe|*postgres.exe|*wmiapsrv.exe|*wmiprvse.exe"

Full blacklist:

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist1 = EventCode="(4662|566)" Message="Object Type:(?!\s*groupPolicyContainer)"
blacklist2 = EventCode="(4656|4670|4663|4703|4658|4688)" Message="Account Name:(\W+\w+$)"
blacklist4 = EventCode="(4688|4689)" Message="%SplunkUniversalForwarder%"
blacklist5 = EventCode="6278" Message="Network Policy Server granted full access to a user because the host met the defined    health policy."
blacklist6 = EventCode="(4660|4663|4688|4689)" Message="New Process Name:\s*(?i)(?:[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|mongod|splunkd|python|splunk|splunk\-(?:MonitorNoHandle|admon|netmon|perfmon|optimize|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi))\.exe)"
blacklist7 = EventCode="4663" Message="(?:Object Name:)(?s).*(\\REGISTRY\\)"
blacklist8 = EventCode="(4660|4663|4688|4689)" Message="Process Name:\s+*Tei.Content.ContentPublisher.exe|*BBL.exe|*BESRootServer.exe|*BESClient.exe|*elasticsearch-service-x64.exe|*bactalk.exe|*mcshield.exe|*splunk-optimize.exe|*splunk-winevtlog.exe|*bactalk.exe|*w3wp.exe|*Microsoft.Exchange.Diagnostics.Service.exe|*MSExchangeHMWorker.exe|*SearchProtocolHost.exe|*SearchIndexer.exe|*PSMONITORSRV.exe|*nslookup.exe|*traceroute.exe|*postgres.exe|*wmiapsrv.exe|*wmiprvse.exe"
index = security_wineventlog
renderXml = false

Here is what I see when I search (obviously not working)
image?

[Suirand1]

Without creating new topic I will ask here.
SSE Docs provides example of "inputs.conf " on onboarding windows logs with a failing regex line which gets discarded by splunkd :

"blacklist3 = EventCode="4688" Message="New Process Name: (?i)(?:[C-F]:\Program Files\Splunk(?:UniversalForwarder)?\bin\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi)).exe)""
Could somebody provide some fix for this, and correct an error in the DOCS.?

[zward · Accepted solution]

I was able to find the solution for this, it is:

EventCode="(4660|4663|4688|4689)" Message="Process Name:\s+Tei.Content.ContentPublisher.exe|BBL.exe|BESRootServer.exe|BESClient.exe|elasticsearch-service-x64.exe|bactalk.exe|mcshield.exe|splunk-optimize.exe|splunk-winevtlog.exe|bactalk.exe|w3wp.exe|Microsoft.Exchange.Diagnostics.Service.exe|MSExchangeHMWorker.exe|SearchProtocolHost.exe|SearchIndexer.exe|PSMONITORSRV.exe|nslookupexe|traceroute.exe|postgres.exe|wmiapsrv.exe|wmiprvse.exe">

the character "*" is not used in regex in this case!

For anyone struggling this is by far the best place to test out regex:
https://www.regex101.com