How to blacklist specific events on universal forwarder?

[DanAlexander]

Hello, community,

I need help reducing Events containing 4688 and ParentProcessName=*splunkd.exe

There is an excerpt from the log:

 <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid=' XXXXXXXX -4994-a5ba-3e3b0328c30d}'/><EventID>4688</EventID><Version>2</Version><Level>0</Level><Task>13312</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2023-06-13T10:39:41.797279900Z'/><EventRecordID>12536409</EventRecordID><Correlation/><Execution ProcessID='4' ThreadID='15216'/><Channel>Security</Channel><Computer> XXXXXXXX </Computer><Security/></System><EventData><Data Name='SubjectUserSid'>S-1-5-18</Data><Data Name='SubjectUserName'>XXXXXXXX</Data><Data Name='SubjectDomainName'> XXXXXXXX </Data><Data Name='SubjectLogonId'>0 XXXXXXXX 7</Data><Data Name='NewProcessId'>0x2734</Data><Data Name='NewProcessName'>C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe</Data><Data Name='TokenElevationType'>%%1936</Data><Data Name='ProcessId'>0x17d4</Data><Data Name='CommandLine'></Data><Data Name='TargetUserSid'>S-1-0-0</Data><Data Name='TargetUserName'>-</Data><Data Name='TargetDomainName'>-</Data><Data Name='TargetLogonId'>0x0</Data><Data Name='ParentProcessName'>C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</Data><Data Name='MandatoryLabel'>XXXXXXXX -16384</Data></EventData></Event>

Can anyone help me create the appropriate regex I can use within the SEDCMD?

After the reduction the above event the result I am after should look something like this: <EventID>4688</EventID><Data Name='ParentProcessName'>C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</Data>

---------------------------

I currently use: blacklist1 = EventCode="4688" | ParentProcessName="(.*/ParentProcessName \= C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd\.exe)"

Thank you!

[caiosalonso]

Hi,

Are you using the option to render events as Xml in your inputs.conf file? (renderXml=true)

If this is the case, I would recommend you to use the $XmlRegex in your blacklist.

Something like following:

blacklist1=$XmlRegex=<EventID>4688|<Data Name='ParentProcessName'>C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd\.exe

The regex above matches Event ID 4688 or ParentProcessName "C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd\.exe"

[Araton71]

I used

[WinEventLog://Security]
checkpointInterval = 5
current_only = 0
disabled = 0
blacklist1 = EventCode="4688" Message="New Process Name: (?i)(?:[C-F]:\Program Files\Splunk(?:UniversalForwarder)?\bin\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi)).exe)"
start_from = oldest

but it stops all 4688,  like not process other information