Prevent ingestion of "NT AUTHORITY\SYSTEM" EventCode 4663

[sswigart]

I am exceeding my 5GB license. I have determine the problem by doing a 24 hour search using the following:

index="winlogs" host=filesvr souce="WinEventLog:Security" EventCode=4663 Accesses="ReadData (or ListDirectory) Security_ID="NT AUTHORITY\SYSTEM"

The above search returns 4.5 million plus records.

My question is how do I stop Splunk from ingesting     Security_ID="NT AUTHORITY\SYSTEM" of EventCode 4663?

Would appreciate any assistance\suggestions given.

[gcusello]

Hi @sswigart ,

as you can read at https://docs.splunk.com/Documentation/Splunk/9.2.2/Admin/Inputsconf#Event_Log_filtering,

if the logs you indicated aren't relevant for your searches, you can follow the instructons in the above link, adding a blacklist to your inputs.conf in the WinEventLog:Security stanza.

Only one attention point: in the blacklist you must use a regex, not a string to search.

Ciao.

Giuseppe

[PickleRick]

Actually, you can blacklist by eventcodes or by regex. (and with a caveat that if you use renderXml=true, you have to specify blacklist differently).