Need to Disable A Process Name with Event ID

[anandhalagaras1]

We are collecting Wineventlog data from Security, Application & System.

In Security we want to disable a particular Event Code which is having the corresponding New_Process_Name.

 EventCode=4688 

New_Process_Message=C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection Manager\\bin\\xxxx.exe

So how can i write the inputs.conf and blacklist the Eventcode with New_Process_Message. 

Similarly I have around 30 + New_Process_Message for the EventCode=4688 so how can i blacklist all of them.

Kindly help to provide the inputs.conf for the same.

[anandhalagaras1]

Thanks.

But it would be really helpful if you can provide a inputs config file so that i can check on the same.

[isoutamo]

Hi

I believe that this posting helps you. https://www.hurricanelabs.com/splunk-tutorials/windows-event-log-filtering-design-in-splunk
r. Ismo

[anandhalagaras1]

Hi All,

I have tried to disable EventCode=4688 with New Process Name filtration but the logs are still getting ingested into Splunk.

@isoutamo @woodcock Hence kindly help on my request.

Here are my inputs.conf

blacklist = EventCode="4688" Message="(?:New Process Name:).+(?:Windows\\System32\\conhost.exe)"
blacklist0 = EventCode="4688" Message="(?:New Process Name:).+(?:SplunkUniversalForwarder\\bin\\splunk-winhostinfo.exe)"
blacklist1 = EventCode="4688" Message="(?:New Process Name:).+(?:Symantec\\Symantec Endpoint Protection Manager\\bin\\USNWash.exe)"
blacklist2 = EventCode="4688" Message="(?:New Process Name:).+(?:Symantec\\Symantec Endpoint Protection Manager\\bin\\XDelta64\\xdelta3.exe)"
blacklist3 = EventCode="4688" Message="(?:New Process Name:).+(?:Symantec\\Symantec Endpoint Protection Manager\\tomcat\\bin\\sempub.exe)"

So kindly help to correct me where is the gap. So that i can update the same for the rest of the "New Process Name".

[anandhalagaras1]

Can anyone help on my request please.