Splunk Search

Blacklisting Windows EventCodes

Bo3432
Explorer

I am trying to remove window EventCodes 4688 and 4627. Nothing I have tried has worked. Her are the things that I have tried. This is on the inputs.conf.

blacklist = EventCode="4688" Message="(?:New Process Name:).+(?:SplunkUniversalForwarder\bin\splunk.exe)|.+(?:SplunkUniversalForwarder\bin\splunkd.exe)|.+(?:SplunkUniversalForwarder\bin\btool.exe)|.+(?:Splunk\bin\splunk.exe)|.+(?:Splunk\bin\splunkd.exe)|.+(?:Splunk\bin\btool.exe)|.+(?:Agent\MonitoringHost.exe)"

blacklist1= EventCode="4688"
blacklist2= EventCode="4627"

blacklist= EventCode=4627,4688

blacklist = EventCode=4627|4688

blacklist= EventCode=%^(4627|4688)$%

blacklist= EventCode=%^4627$%

blacklist= EventCode=%^4688$%








Labels (1)
0 Karma

Bo3432
Explorer

I've tried both of those. I forgot to put EventCode=  in a couple examples 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You mix two different things. One is blacklisting by eventID

blacklist=4627,4688

or

blacklist3=4627,4688

(of course it can be blacklist1 all the way to blacklist9).

That should work for any event format.

The other format is filtering based on event's contents (which might also include the EventID field).

And the equivalent would be

blacklist=EventCode=%^(4627|3688)$%

You can of course specify a different delimiter for your regex so it might be for example

blacklist=EventCode=+^(4627|3688)$+
0 Karma

soniya-01
Loves-to-Learn
  1. Event Code Watchlist:

    • Think of your computer as a detective, always keeping an eye on what's happening. EventCodes are like clues or signals.
  2. Blacklist = Unwanted Events:

    • Blacklisting is saying, "I don't want these specific clues or signals." It's like telling the detective to ignore certain types of information.
  3. Filtering Out Unwanted Stuff:

    • Imagine you're sorting through mail. Blacklisting is like throwing away letters from certain senders you don't want to hear from.
  4. Improving Focus:

    • By blacklisting EventCodes, you're helping your computer focus on the events that matter and ignoring the ones that don't.
  5. Less Noise, More Clarity:

    • It's like reducing background noise so you can hear the important stuff clearly. Blacklisting helps your computer concentrate on significant events.
0 Karma

Bo3432
Explorer

I know the purpose of blacklist 

0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...