windows logs filtering based on event IDs impact analysis

[SunilMaharishi]

Hello Team ,

I have been working on filtering of some noisy windows event logs from indexing and before doing this in UF , I need to analyze if default ES dashboards and other datamodel related stuff gets impacted ?

Main thing I want to know is if I filter 1234 eventcode from indexing , does it impact any field extraction from windows logs for other data getting indexed . any key value pair like user details which extracted from one particular event and used for all logs ?

what all eventcodes are ok to filter if anyone can suggest ?

[lakshman239 · Accepted solution]

What EventCodes to allow and filter really depends on your use cases - e.g. for Authentication - failed/success, you would need to capture 4624 and 4625. So, please review your requirements and discuss with your users/business.

In terms of what is needed to power the dashboard, you can refer to https://docs.splunk.com/Documentation/ES/5.2.1/Admin/Dashboardrequirements

You can also refer to https://www.ultimatewindowssecurity.com/securitylog/quickref/Default.aspx to understand the bare minimum eventCode you need to better monitor your events. Pls note each customer install is different, so your requirement may need more or less eventCodes.

[p_gurav]

Below links may be useful to you :

https://docs.splunk.com/Documentation/ES/5.2.1/Install/Planyourdatainputs#Considerations_for_data_in...
https://docs.splunk.com/Documentation/Splunk/7.2.3/Data/MonitorWindowseventlogdata