Getting Data In

Need to Disable A Process Name with Event ID

anandhalagaras1
Path Finder

We are collecting Wineventlog data from Security, Application & System.

In Security we want to disable a particular Event Code which is having the corresponding New_Process_Name.

 EventCode=4688 

New_Process_Message=C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection Manager\\bin\\xxxx.exe

So how can i write the inputs.conf and blacklist the Eventcode with New_Process_Message. 

 

Similarly I have around 30 + New_Process_Message for the EventCode=4688 so how can i blacklist all of them.

 

Kindly help to provide the inputs.conf for the same.

 

Labels (1)
0 Karma

anandhalagaras1
Path Finder

Thanks.

But it would be really helpful if you can provide a inputs config file so that i can check on the same.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
0 Karma

anandhalagaras1
Path Finder

Hi All,

I have tried to disable EventCode=4688 with New Process Name filtration but the logs are still getting ingested into Splunk.

@isoutamo @woodcock Hence kindly help on my request.

Here are my inputs.conf

blacklist = EventCode="4688" Message="(?:New Process Name:).+(?:Windows\\System32\\conhost.exe)"
blacklist0 = EventCode="4688" Message="(?:New Process Name:).+(?:SplunkUniversalForwarder\\bin\\splunk-winhostinfo.exe)"
blacklist1 = EventCode="4688" Message="(?:New Process Name:).+(?:Symantec\\Symantec Endpoint Protection Manager\\bin\\USNWash.exe)"
blacklist2 = EventCode="4688" Message="(?:New Process Name:).+(?:Symantec\\Symantec Endpoint Protection Manager\\bin\\XDelta64\\xdelta3.exe)"
blacklist3 = EventCode="4688" Message="(?:New Process Name:).+(?:Symantec\\Symantec Endpoint Protection Manager\\tomcat\\bin\\sempub.exe)"

 

So kindly help to correct me where is the gap. So that i can update the same for the rest of the "New Process Name".

 

 

Tags (1)
0 Karma

anandhalagaras1
Path Finder

Can anyone help on my request please.

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...