Getting Data In

What might be the reason for excessive logs in Windows event?

omprakash9998
Path Finder

I have around 800 users in my environment and the count of 4624 and 4634 is around 80,000 for the last 15 minutes. What might be the reason.

Thank you,

Labels (1)
Tags (1)
0 Karma
1 Solution

nickhills
Ultra Champion

Pro Tip:

Decide which login events you really care about (maybe check with security team if applicable)
However, most of your 4624s will probably be LoginType 3 - Which is network access - you may see this every time you access anything on the network, even if you don't actually open/edit a file etc.

You may decide that you only care about:
LoginType 2 - Interactive (ie with a keyboard attached to the system)
Type7 - Unlocking a workstation, or
Type 10 - remote Interactive (ie RDP/remote access etc)

you could blacklist types 1,3,4,5,6,8,9 and reduce your login events to a fraction of what you have right now, whilst preserving the most important/relevant ones.

blacklist = EventCode="4624" Message="LogonType=(1|3|4|5|6|8|9)"

or to just drop type 3
blacklist1 = EventCode="4624" Message="LogonType=3"

If my comment helps, please give it a thumbs up!

View solution in original post

nickhills
Ultra Champion

Pro Tip:

Decide which login events you really care about (maybe check with security team if applicable)
However, most of your 4624s will probably be LoginType 3 - Which is network access - you may see this every time you access anything on the network, even if you don't actually open/edit a file etc.

You may decide that you only care about:
LoginType 2 - Interactive (ie with a keyboard attached to the system)
Type7 - Unlocking a workstation, or
Type 10 - remote Interactive (ie RDP/remote access etc)

you could blacklist types 1,3,4,5,6,8,9 and reduce your login events to a fraction of what you have right now, whilst preserving the most important/relevant ones.

blacklist = EventCode="4624" Message="LogonType=(1|3|4|5|6|8|9)"

or to just drop type 3
blacklist1 = EventCode="4624" Message="LogonType=3"

If my comment helps, please give it a thumbs up!

avery2007
Explorer

Has anyone inserted this in the inputs.conf that has the appropriate regex to make this work?

0 Karma

96nick
Communicator

While years late, hopefully this helps someone out in the future. This works:

blacklist1 = EventCode="4624" Message="Logon Type:\s+3"
blacklist2 = EventCode="4634" Message="Logon Type:\s+3"

 

yannK
Splunk Employee
Splunk Employee

if your problem is too much verbose events from wineventlog, causing higher license usage
you can a use a blacklist filter on the splunk inputs.conf to exclude them from the monitoring.

see wineventlog whitelist/blacklist settings
http://docs.splunk.com/Documentation/Splunk/7.0.1/Data/MonitorWindowseventlogdata

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...