Getting Data In

Sudden excessive WinEventLog:Security events involving splunkd.exe

nk-1
Path Finder

Splunk Universal Forwarder is v6.4.x
Splunk Server is v6.5.x

In C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf , I have:

[WinEventLog://Security]
disabled = 0
index = wmi

I would normally see about 240 WinEventLog://Security "splunkd.exe" events logged per hour (for weeks).
Suddenly, that number jumped to over 4 million WinEventLog://Security "splunkd.exe" events logged per hour, and my indexing limit was exceeded.

Here's what gets logged:

TIMESTAMP
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5156
EventType=0
Type=Information
ComputerName=HOSTNAME
TaskCategory=Filtering Platform Connection
OpCode=Info
RecordNumber=X
Keywords=Audit Success
Message=The Windows Filtering Platform has permitted a connection.

Application Information:
Process ID: XXX
Application Name: \device\harddiskvolume2\program files\splunkuniversalforwarder\bin\splunkd.exe

Network Information:
Direction: Outbound
Source Address: 10.X.X.X
Source Port: XXX
Destination Address: 172.X.X.X
Destination Port: XXX
Protocol: 6

Filter Information:
Filter Run-Time ID: XXX
Layer Name: Connect
Layer Run-Time ID: X

What could have possibly changed in a Windows machine that suddenly makes it log so much WinEventLog:Security "splunkd.exe" events?

I could set disabled=1, but then I'd lose the ability to track who is logging in/out of that machine.
Is there any way to just omit logging these kind of "Audit Success" / "The Windows Filtering Platform has permitted a connection" events?

1 Solution

nk-1
Path Finder

Found an answer right here - http://answers.splunk.com/answers/53422/eventcode-5156.html


auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:enable

View solution in original post

0 Karma

chanthongphiob
Path Finder

Did you ever figure out why the "Application Name: \device\harddiskvolume2\program files\splunkuniversalforwarder\bin\splunkd.exe" was making excessive connections to the machine? I have also run into this issue, but would like to know the root cause of excessive connections, and not excessive logs.

0 Karma

nk-1
Path Finder

The excessive WinEventLog:Security events started the day some updates were pushed to the machine:
Microsoft Security Update for .NET
McAfee product updates (including Firewall update)

Hmm... But it could have been something else that triggered it too.

0 Karma

nk-1
Path Finder

Found an answer right here - http://answers.splunk.com/answers/53422/eventcode-5156.html


auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:enable

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...