WinEventLog sourcetype do not match when applied in SEDCMD

[DanAlexander]

Hello, community,

I am having a problem understanding why the WinEventLog sourcetype cannot be accepted as other sourcetypes I have worked with.

Is this WinEventLog should be declared as [WinEventLog] in props.conf when using SEDCMD or it should have a different declaration within the square brackets?

Thank you 

[richgalloway]

The name within brackets in props.conf should be the same name on a sourcetype= line in inputs.conf.  Whether that's "WinEventLog" or something else, they need to match.

That said, I know that SEDCMD works with Windows events so there are no restrictions on using it in certain sourcetypes. 

Share your props.conf settings and we may be able to be more specific.

[DanAlexander]

Hi @richgalloway,

Thanks for the reply.

Here is what I have used in props.conf

WinEventLog]

SEDCMD=s/(.+)(<EventID>\d+</EventID>)(.*)(<Data Name='ParentProcessName'>.+?</Data>)(.*)/\2\4/g

[richgalloway]

Did you run that regular expression through regex101.com?  It looks like it needs a lot of escape characters.  If the regex is invalid or doesn't match the data then SEDCMD will not work.

[DanAlexander]

There is an excerpt from the log:

 <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid=' XXXXXXXX -4994-a5ba-3e3b0328c30d}'/><EventID>4688</EventID><Version>2</Version><Level>0</Level><Task>13312</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2023-06-13T10:39:41.797279900Z'/><EventRecordID>12536409</EventRecordID><Correlation/><Execution ProcessID='4' ThreadID='15216'/><Channel>Security</Channel><Computer> XXXXXXXX </Computer><Security/></System><EventData><Data Name='SubjectUserSid'>S-1-5-18</Data><Data Name='SubjectUserName'>XXXXXXXX</Data><Data Name='SubjectDomainName'> XXXXXXXX </Data><Data Name='SubjectLogonId'>0 XXXXXXXX 7</Data><Data Name='NewProcessId'>0x2734</Data><Data Name='NewProcessName'>C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe</Data><Data Name='TokenElevationType'>%%1936</Data><Data Name='ProcessId'>0x17d4</Data><Data Name='CommandLine'></Data><Data Name='TargetUserSid'>S-1-0-0</Data><Data Name='TargetUserName'>-</Data><Data Name='TargetDomainName'>-</Data><Data Name='TargetLogonId'>0x0</Data><Data Name='ParentProcessName'>C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</Data><Data Name='MandatoryLabel'>XXXXXXXX -16384</Data></EventData></Event>

[richgalloway]

Did you put this into regex101.com to see if it works with the expression in your SEDCMD?  I hope you don't expect me to do that.

[DanAlexander]

I need to remove the events from 4688 splunkd related. I do not want to see events coming from clients.

[DanAlexander]

Apologies, opening bracket is in place. That was a copy/paste typo.