Blacklists

[Douglas]

Hello! 

So here is a doozy. 

We have blacklists in place using Regx. In particular this one:

[WinEventLog://Microsoft-Windows-Sysmon/Operational]
source= XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
disabled = false
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist1 = $XmlRegex= (C:\\Program Files\\Preton\\PretonSaver\\PretonService.exe)

along with some other blacklists in sequence as blacklist2, blacklist3 etc. 

Now, on my and some colleagues local machines where I have tested the inputs.conf file to see if we are blacklisting correctly, it all works, no logs come into splunk cloud.

BUT when this is deployed using our deployment server to the estate the blacklist doesnt work. 

Does anybody know where i can troubleshoot this from?  Ive ran the btool and confs come out fine. 

we are local UF agents going to a DS then to Splunk Cloud. 

[Ulwur2]

Why use blacklists at all?  Sysmon has excellent means of filtering what you want logged and not. 

[ashurack_qmulos]

Yup, that would work too.

Sysmon - Configuration Files 
Sysmon - Event Filtering 

[ashurack_qmulos]

Is renderXml = 1 set on the input for working and non-working?

And any chance what you have working locally includes delimiters around the regex?  Ex... 

blacklist1 = $XmlRegex="(C:\\Program Files\\Preton\\PretonSaver\\PretonService.exe)"

inputs.conf - Splunk Documentation

* key=regex format:
[...]
  * The regex consists of a leading delimiter, the regex expression, and a
    trailing delimiter. Examples: %regex%, *regex*, "regex"
[...]

[Douglas]

Hi, 

thanks for the responses. Much appreciated. 

We have done the blacklists as its easier to do under our Change Board ( we have preauths) and need a longer period of time to do major changes like the sysmon one. So went, in the short term, with the blacklist. 

Found that I have to alter the regex slightly to get it working, then ive waited around a week for all devices to check in with the DS and get the new config. Strange though, even with the new inputs.conf the devices still push out logs for a few hours then nothing. Actually expected a full blown STOP. But hey ho.