Filtering Windows 4662 logs in Windows - Not working?

[kknair007]

Hello all,

I am trying to filter out those noisy 4662 logs eating our license like anything as recommended in Splunk blogs and forums.

Tried the below stanza for 4662 to blacklist everything except GPO related events, but not working as expected. Any help to fix the regex part.

blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)"

Raw Message is below : 

Message=An operation was performed on an object. Subject : Security ID: $ Account Name: $ Account Domain:  Logon ID: 0x7F897031 Object: Object Server: DS Object Type: groupPolicyContainer Object Name: CN={123456-D64E-4013-ACC5-F78A}CN=Policies,CN=System,DC=xyz,DC=xyyz,DC=com Handle ID: 0x0 Operation: Operation Type: Object Access Accesses: Read Property Access Mask: 0x10 Properties: --- Public Information distinguishedName groupPolicyContainer Additional Information: Parameter 1: - Parameter 2:

Can we filter directly based on Object_Type instead of Message field like : 

blacklist1 = EventCode="4662" Object_Type="(x|y)". 

Any help would be great! Thanks.

[mweb]

I know this is an old thread, but we have this in our Windows_TA local.conf

blacklist1 = EventCode="4662|566" Message="Object Type:(?!\s*groupPolicyContainer)"

[richgalloway]

There is only whitespace between "Object Type:" and the value so "\s*" is correct.  The characters before "Object Type" are skipped automatically.

If the goal is to index only events of a certain Object Type then you probably want a whitelist rather than blacklist.

[kknair007]

@richgalloway I tried the below as you suggested, not working. 

blacklist = EventCode="4662" Message="Object Type:\s*(dnsNode|dnsZone|container|computer|SecretObject)"

\s* caters to all whitespaces. What about other characters and numbers in Message field which has to be matched since Object Type is coming somewhere in the middle as per the raw event. 

Can you pls shed some light on this regex, Rich?

[richgalloway]

Object_Type is not one of the supported fields for blacklist.  IME, Splunk does not handle lookahead/lookbehind well, so try to avoid them.  Have you tried this?

blacklist1 = EventCode="4662" Message="Object Type:\s*(x|y)"