Getting Data In

WMI filtering only eventlog from some users

pmelchiori
Explorer

I'm looking for a way to filter all the log eventlog from certain user's group (SYSTEM and Administrator), but all my test going bad 😞

(splunk 4.1.6)

prof.conf:

[wmi]
TRANSFORMS-wminull = wmi-null, wmi-parsing

transforms.conf

[wmi-null]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue  

[wmi-parsing]
REGEX = (?m)^User=(SYSTEM|Administrator)
DEST_KEY = queue
FORMAT = nullQueue
0 Karma

sdwilkerson
Contributor

pmelchiori,

It looks like you have the syntax mostly right, but you need to check a few things.

Is the sourcetype that you want to drop just "wmi" or is it "wmi:WinEventLog:Security" etc? Make sure this is explicit.

Additionally, your transform will apply to a SOURCE_KEY = _raw unless otherwise stated. Your _raw will probably be equal to the entire event. That would mean that the string "user=XXX" is NOT at the beginning of the event, and therefore you don't want the carat "^" in your regex.

Finally, you have two transforms, that do two different things. The top one has a REGEX = (.).
In Regex, a dot "." means match any single character. So, this will match anything and mark it all to the nullQueue. I am not sure your intention here, but you may want to adjust this or maybe even omit the first transform in lieu of the second.

Check the sourcetype, check your transforms, fix that in props.conf and then remove your carat and see how that goes.

Best,

Sean

sdwilkerson
Contributor

See my updated answer above.

0 Karma

pmelchiori
Explorer

Okay, I've made all the changes but it still archiving any log!

Switching the props.conf in wmi:WinEventLog:Security it stops working totally.

0 Karma

MarioM
Motivator

did you try the followings:

REGEX = (.)

AND/OR

REGEX = (?msi)^User=(SYSTEM|Administrator)
0 Karma

pmelchiori
Explorer

Yes, it does't filter anything, I can see all the logs in Splunk.

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...