We are collecting Wineventlog data from Security, Application & System.
In Security we want to disable a particular Event Code which is having the corresponding New_Process_Name.
EventCode=4688
New_Process_Message=C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection Manager\\bin\\xxxx.exe
So how can i write the inputs.conf and blacklist the Eventcode with New_Process_Message.
Similarly I have around 30 + New_Process_Message for the EventCode=4688 so how can i blacklist all of them.
Kindly help to provide the inputs.conf for the same.
Thanks.
But it would be really helpful if you can provide a inputs config file so that i can check on the same.
Hi
I believe that this posting helps you. https://www.hurricanelabs.com/splunk-tutorials/windows-event-log-filtering-design-in-splunk
r. Ismo
Hi All,
I have tried to disable EventCode=4688 with New Process Name filtration but the logs are still getting ingested into Splunk.
@isoutamo @woodcock Hence kindly help on my request.
Here are my inputs.conf
blacklist = EventCode="4688" Message="(?:New Process Name:).+(?:Windows\\System32\\conhost.exe)"
blacklist0 = EventCode="4688" Message="(?:New Process Name:).+(?:SplunkUniversalForwarder\\bin\\splunk-winhostinfo.exe)"
blacklist1 = EventCode="4688" Message="(?:New Process Name:).+(?:Symantec\\Symantec Endpoint Protection Manager\\bin\\USNWash.exe)"
blacklist2 = EventCode="4688" Message="(?:New Process Name:).+(?:Symantec\\Symantec Endpoint Protection Manager\\bin\\XDelta64\\xdelta3.exe)"
blacklist3 = EventCode="4688" Message="(?:New Process Name:).+(?:Symantec\\Symantec Endpoint Protection Manager\\tomcat\\bin\\sempub.exe)"
So kindly help to correct me where is the gap. So that i can update the same for the rest of the "New Process Name".
Can anyone help on my request please.