Splunk Enterprise

Windows XML Filtering with $XmlRegex doesn't work on every machine

CallumP
Engager

I have two separate deployment apps going to separate classes. One we'll call A is working great with full event filtering and blacklisting via $XmlRegex in inputs.conf see below:

 

whitelist1 = $XmlRegex="<EventID>(1|12|13|6|1100|4624|4625|4634|4648|4663|4672|4688|4719|4722|4724|4732|4733|4735|4737|4739|4778|4779|4946|5140)<\/EventID>"
blacklist1 = $XmlRegex="<EventID>4688<\/EventID>.*<Data Name='NewProcessName'>[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi))\.exe"

 

This is under the WinEventLog stanza. I've now copied this over to class B with more hosts but this whitelist / blacklist isn't working. Our license is getting hit hard by the 4688 events and so need to trim them down considerably.

I've read other similar questions but we're using Xml Windows logs so classic responses don't work, I have also tried outright blocking it with props and transforms on our intermediate heavy forwarder with no success there either so either inputs or props and transforms help would be great

Labels (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @CallumP,

Splunk_TA_windows app already has blacklist1 and blacklist2. Please try with blacklist3 lie below. 

The difference between serverclasses maybe Splunk_TA_windows app existence.

whitelist3 = $XmlRegex="<EventID>(1|12|13|6|1100|4624|4625|4634|4648|4663|4672|4688|4719|4722|4724|4732|4733|4735|4737|4739|4778|4779|4946|5140)<\/EventID>"
blacklist3 = $XmlRegex="<EventID>4688<\/EventID>.*<Data Name='NewProcessName'>[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi))\.exe"
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @CallumP,

Splunk_TA_windows app already has blacklist1 and blacklist2. Please try with blacklist3 lie below. 

The difference between serverclasses maybe Splunk_TA_windows app existence.

whitelist3 = $XmlRegex="<EventID>(1|12|13|6|1100|4624|4625|4634|4648|4663|4672|4688|4719|4722|4724|4732|4733|4735|4737|4739|4778|4779|4946|5140)<\/EventID>"
blacklist3 = $XmlRegex="<EventID>4688<\/EventID>.*<Data Name='NewProcessName'>[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi))\.exe"
If this reply helps you an upvote and "Accept as Solution" is appreciated.

AL3Z
Builder

Hi @scelikok ,

Why is everything associated with EventCode="4688" being blocked after applying this Regex blacklist?

blacklist3 = $XmlRegex="<EventID>4688<\/EventID>.*<Data Name=('NewProcessName'|'ParentProcessName')>[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi))\.exe"

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...