Hi all,
after the last Windows update (JAN-2022) a windows_TA input blacklist filter for security logevents does not work anymore. before it worked fine. the black filter looks like this:
blacklist =EventCode="(4634|4672)" Message="Account\sName:\s+(?i)([\S+]+[\$]|serviceaccount1|serviceaccount2)"
the blacklist should filter out computer accounts and other service accounts for certain eventcode.
has someone the same problem/ can someone help with that?
Thanks a lot
