Use a custom source type for specific Windows firewall events

[coenvandijk]

We use Splunk for storing and analyzing Windows security events. We now want to start storing firewall events related tot management ports.

I plan to use the following for retrieving the relevant data from the Windows security log

whitelist9 = EventCode="(?:515[67])" Message="(?i)Direction\:\t+Inbound" Message="Destination\sPort\:\t+(135|139|445|3389|5985|5986)"

I would like to store these events using a diiferent source type than the other events from [WinEventLog://Security]

How can I achieve this?

[PickleRick]

Whg do you specifically want to do this as other sourcetype?

[ldongradi_SPL]

You want to index all the events from that WinEventLog, so you can't do that from the UF inputs.conf.

You need the parser (HF or Indexer) to apply a different treatment for those specific events :

props.conf
[source::TheWindowsSecurityLog]
TRANSFORMS = firewall_only

transforms.conf
[firewall_only]
REGEX = EventCode=515[67]
DEST_KEY = MetaData:SourceType
FORMAT = sourcetype::wineventlog_firewall

The REGEX probably needs some modification, but the spirit is to give a specific redirection for only those events that match the expression.

All the other events will follow the natural process.

No need for a blacklist/whitelist from the UF inputs.conf.