All Apps and Add-ons

Windows Process Name inputs.conf Blacklisting Regex Help

zward
Path Finder

I am in desperate need of some help on regex/blacklisting process names in Windows Event logs. Our regex to exclude / filter out specific Process Name executables is not working and I would guess it likely is due to improper regex. I could definitely use any advice or help on the below regex as I am by no means an expert, but have done my best to try and get it working, but I just can't seem to get it. Right now the 4663 processes are completely overwhelming our licensing due to the amount of events being generated.

Here is our regex code that is not functioning (blacklist8). Below that is our full blacklist. This is being done via Windows_TA inputs.conf file within the local directory being deployed to all universal forwarders. I am trying to exclude any message received by Windows that shows Process Name as one of the executables.
Thank you so much for your help!

Line that is not working:

blacklist8 = EventCode="(4660|4663|4688|4689)" Message="Process Name:\s+*Tei.Content.ContentPublisher.exe|*BBL.exe|*BESRootServer.exe|*BESClient.exe|*elasticsearch-service-x64.exe|*bactalk.exe|*mcshield.exe|*splunk-optimize.exe|*splunk-winevtlog.exe|*bactalk.exe|*w3wp.exe|*Microsoft.Exchange.Diagnostics.Service.exe|*MSExchangeHMWorker.exe|*SearchProtocolHost.exe|*SearchIndexer.exe|*PSMONITORSRV.exe|*nslookup.exe|*traceroute.exe|*postgres.exe|*wmiapsrv.exe|*wmiprvse.exe"

Full blacklist:

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist1 = EventCode="(4662|566)" Message="Object Type:(?!\s*groupPolicyContainer)"
blacklist2 = EventCode="(4656|4670|4663|4703|4658|4688)" Message="Account Name:(\W+\w+$)"
blacklist4 = EventCode="(4688|4689)" Message="%SplunkUniversalForwarder%"
blacklist5 = EventCode="6278" Message="Network Policy Server granted full access to a user because the host met the defined    health policy."
blacklist6 = EventCode="(4660|4663|4688|4689)" Message="New Process Name:\s*(?i)(?:[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|mongod|splunkd|python|splunk|splunk\-(?:MonitorNoHandle|admon|netmon|perfmon|optimize|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi))\.exe)"
blacklist7 = EventCode="4663" Message="(?:Object Name:)(?s).*(\\REGISTRY\\)"
blacklist8 = EventCode="(4660|4663|4688|4689)" Message="Process Name:\s+*Tei.Content.ContentPublisher.exe|*BBL.exe|*BESRootServer.exe|*BESClient.exe|*elasticsearch-service-x64.exe|*bactalk.exe|*mcshield.exe|*splunk-optimize.exe|*splunk-winevtlog.exe|*bactalk.exe|*w3wp.exe|*Microsoft.Exchange.Diagnostics.Service.exe|*MSExchangeHMWorker.exe|*SearchProtocolHost.exe|*SearchIndexer.exe|*PSMONITORSRV.exe|*nslookup.exe|*traceroute.exe|*postgres.exe|*wmiapsrv.exe|*wmiprvse.exe"
index = security_wineventlog
renderXml = false

Here is what I see when I search (obviously not working)
image?Blacklist failing

0 Karma
1 Solution

zward
Path Finder

I was able to find the solution for this, it is:

EventCode="(4660|4663|4688|4689)" Message="Process Name:\s+Tei.Content.ContentPublisher.exe|BBL.exe|BESRootServer.exe|BESClient.exe|elasticsearch-service-x64.exe|bactalk.exe|mcshield.exe|splunk-optimize.exe|splunk-winevtlog.exe|bactalk.exe|w3wp.exe|Microsoft.Exchange.Diagnostics.Service.exe|MSExchangeHMWorker.exe|SearchProtocolHost.exe|SearchIndexer.exe|PSMONITORSRV.exe|nslookupexe|traceroute.exe|postgres.exe|wmiapsrv.exe|wmiprvse.exe">

the character "*" is not used in regex in this case!

For anyone struggling this is by far the best place to test out regex:
https://www.regex101.com

View solution in original post

0 Karma

Suirand1
Explorer

Without creating new topic I will ask here.
SSE Docs provides example of "inputs.conf " on onboarding windows logs with a failing regex line which gets discarded by splunkd :

"blacklist3 = EventCode="4688" Message="New Process Name: (?i)(?:[C-F]:\Program Files\Splunk(?:UniversalForwarder)?\bin\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi)).exe)""
Could somebody provide some fix for this, and correct an error in the DOCS.?

0 Karma

zward
Path Finder

I was able to find the solution for this, it is:

EventCode="(4660|4663|4688|4689)" Message="Process Name:\s+Tei.Content.ContentPublisher.exe|BBL.exe|BESRootServer.exe|BESClient.exe|elasticsearch-service-x64.exe|bactalk.exe|mcshield.exe|splunk-optimize.exe|splunk-winevtlog.exe|bactalk.exe|w3wp.exe|Microsoft.Exchange.Diagnostics.Service.exe|MSExchangeHMWorker.exe|SearchProtocolHost.exe|SearchIndexer.exe|PSMONITORSRV.exe|nslookupexe|traceroute.exe|postgres.exe|wmiapsrv.exe|wmiprvse.exe">

the character "*" is not used in regex in this case!

For anyone struggling this is by far the best place to test out regex:
https://www.regex101.com

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...