Getting Data In

Security Event whitelist regex filter

Engager

I need to filter logon event (eventcode = 4624) only for user with name SA-*

New Logon:
Security ID: TEST\SA-user01
Account Name: SA-User01
Account Domain: TEST

Can i configure inputs.conf to whitelist only this kind of event?

Thanks

0 Karma
1 Solution

Engager

only with this string work fine:

whitelist = Message="\\[sS][aA]\-" EventCode="4624"

in logon event "User" is N/A

Thanks

View solution in original post

0 Karma

Engager

only with this string work fine:

whitelist = Message="\\[sS][aA]\-" EventCode="4624"

in logon event "User" is N/A

Thanks

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

see the documentation (need at least splunk 6.1 )
http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/MonitorWindowsdata > Create advanced filters with whitelist and blacklist

try
whitelist= User=SA-* EventCode=4624

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!