Getting Data In

How do you filter custom events in Windows Security log using regular expression in blacklist?

jzinguer
New Member

Hello,

We have Splunk Enterprise 7.2 with Deployment Server role and Splunk Universal forwarder on a Windows SQL server.

The SQL server has custom event in Windows Security Log.

Below is a portion of the Event Message.

I need to create the blacklist entry in the inputs.conf file to filter out events where two patterns are match ing at the same time.

"class_type:LX" AND "server_principal_name:DOMAIN1\"
The second pattern is 3 lines below of the first pattern.

Any help will be greatly appreciated.

Thank you,

Joseph

session_id:174
server_principal_id:274
database_principal_id:0
target_server_principal_id:0
target_database_principal_id:0
object_id:0
user_defined_event_id:0
transaction_id:0
class_type:LX
permission_bitmask:00000000000000000000000000000000
sequence_group_id:A842D899-40A5-491E-886C-A8E7F7682BDD
session_server_principal_name:DOMAIN1\sqlservice
server_principal_name:DOMAIN1\sqlservice
server_principal_sid:010500000000000515000000093a2a243fad146207e53b2b2f0a0000
database_principal_name:
target_server_principal_name:
target_server_principal_sid:
target_database_principal_name:
0 Karma

jzinguer
New Member

It looks like the blacklist record below in the inputs.conf file is working for me:
blacklist = Message="(?si)(\bclass_type:LX.+(?=\bserver_principal_name:DOMAIN1.+))"
Any comments are welcome. I am not sure if this will be the best option.
Cheers.
Joseph

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...