Filtering Windows Security Events based on blacklist

[jasonheb]

Hello
I am using Splunk UF 6.1.4 on my Windows Domain controllers to monitor windows events. I've put in place a working blacklist to filter out a number of events and that works fine. The issue I have is I also want to filter out an EventCode 4776 where the Error_Cdoe is 0x0

**[WinEventLog://Security]
disabled = 0
start_from = oldest
evt_resolve_ad_obj = 1
checkpointInterval = 5
index = soc
ignoreOlderThan = 2d

whitelist = Category=9

blacklist1 = 4624,4634,4658,4656,4690,4661,4662,5136,5137,538,675,540,566,565,562
blacklist2 = EventCode="4776" Error_Code="0x0"**

As I say the blacklist1 list works,

Or should I be setting blacklist2 to
blacklist2 = EventCode="4776" Message="Error Code:*0x0"

[jasonheb · Accepted solution]

Ok sorted it - The Message needs to include the line for the Error Code
In this case I went for simple exact string match which worked fine
blacklist2 = EventCode="4776" Message="Error Code: 0x0"