Splunk Enterprise Security

windows logs filtering based on event IDs impact analysis

SunilMaharishi
Path Finder

Hello Team ,

I have been working on filtering of some noisy windows event logs from indexing and before doing this in UF , I need to analyze if default ES dashboards and other datamodel related stuff gets impacted ?

Main thing I want to know is if I filter 1234 eventcode from indexing , does it impact any field extraction from windows logs for other data getting indexed . any key value pair like user details which extracted from one particular event and used for all logs ?

what all eventcodes are ok to filter if anyone can suggest ?

0 Karma
1 Solution

lakshman239
SplunkTrust
SplunkTrust

What EventCodes to allow and filter really depends on your use cases - e.g. for Authentication - failed/success, you would need to capture 4624 and 4625. So, please review your requirements and discuss with your users/business.

In terms of what is needed to power the dashboard, you can refer to https://docs.splunk.com/Documentation/ES/5.2.1/Admin/Dashboardrequirements

You can also refer to https://www.ultimatewindowssecurity.com/securitylog/quickref/Default.aspx to understand the bare minimum eventCode you need to better monitor your events. Pls note each customer install is different, so your requirement may need more or less eventCodes.

View solution in original post

0 Karma

lakshman239
SplunkTrust
SplunkTrust

What EventCodes to allow and filter really depends on your use cases - e.g. for Authentication - failed/success, you would need to capture 4624 and 4625. So, please review your requirements and discuss with your users/business.

In terms of what is needed to power the dashboard, you can refer to https://docs.splunk.com/Documentation/ES/5.2.1/Admin/Dashboardrequirements

You can also refer to https://www.ultimatewindowssecurity.com/securitylog/quickref/Default.aspx to understand the bare minimum eventCode you need to better monitor your events. Pls note each customer install is different, so your requirement may need more or less eventCodes.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>