Splunk Enterprise Security

windows logs filtering based on event IDs impact analysis

SunilMaharishi
Path Finder

Hello Team ,

I have been working on filtering of some noisy windows event logs from indexing and before doing this in UF , I need to analyze if default ES dashboards and other datamodel related stuff gets impacted ?

Main thing I want to know is if I filter 1234 eventcode from indexing , does it impact any field extraction from windows logs for other data getting indexed . any key value pair like user details which extracted from one particular event and used for all logs ?

what all eventcodes are ok to filter if anyone can suggest ?

0 Karma
1 Solution

lakshman239
Influencer

What EventCodes to allow and filter really depends on your use cases - e.g. for Authentication - failed/success, you would need to capture 4624 and 4625. So, please review your requirements and discuss with your users/business.

In terms of what is needed to power the dashboard, you can refer to https://docs.splunk.com/Documentation/ES/5.2.1/Admin/Dashboardrequirements

You can also refer to https://www.ultimatewindowssecurity.com/securitylog/quickref/Default.aspx to understand the bare minimum eventCode you need to better monitor your events. Pls note each customer install is different, so your requirement may need more or less eventCodes.

View solution in original post

0 Karma

lakshman239
Influencer

What EventCodes to allow and filter really depends on your use cases - e.g. for Authentication - failed/success, you would need to capture 4624 and 4625. So, please review your requirements and discuss with your users/business.

In terms of what is needed to power the dashboard, you can refer to https://docs.splunk.com/Documentation/ES/5.2.1/Admin/Dashboardrequirements

You can also refer to https://www.ultimatewindowssecurity.com/securitylog/quickref/Default.aspx to understand the bare minimum eventCode you need to better monitor your events. Pls note each customer install is different, so your requirement may need more or less eventCodes.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...