Blacklisting Windows EventCodes

[Bo3432]

I am trying to remove window EventCodes 4688 and 4627. Nothing I have tried has worked. Her are the things that I have tried. This is on the inputs.conf.

blacklist = EventCode="4688" Message="(?:New Process Name:).+(?:SplunkUniversalForwarder\bin\splunk.exe)|.+(?:SplunkUniversalForwarder\bin\splunkd.exe)|.+(?:SplunkUniversalForwarder\bin\btool.exe)|.+(?:Splunk\bin\splunk.exe)|.+(?:Splunk\bin\splunkd.exe)|.+(?:Splunk\bin\btool.exe)|.+(?:Agent\MonitoringHost.exe)"

blacklist1= EventCode="4688"
blacklist2= EventCode="4627"

blacklist= EventCode=4627,4688

blacklist = EventCode=4627|4688

blacklist= EventCode=%^(4627|4688)$%

blacklist= EventCode=%^4627$%

blacklist= EventCode=%^4688$%

[Bo3432]

I've tried both of those. I forgot to put EventCode=  in a couple examples 

[PickleRick]

You mix two different things. One is blacklisting by eventID

blacklist=4627,4688

or

blacklist3=4627,4688

(of course it can be blacklist1 all the way to blacklist9).

That should work for any event format.

The other format is filtering based on event's contents (which might also include the EventID field).

And the equivalent would be

blacklist=EventCode=%^(4627|3688)$%

You can of course specify a different delimiter for your regex so it might be for example

blacklist=EventCode=+^(4627|3688)$+

[soniya-01]

1. Event Code Watchlist:

   • Think of your computer as a detective, always keeping an eye on what's happening. EventCodes are like clues or signals.

2. Blacklist = Unwanted Events:

   • Blacklisting is saying, "I don't want these specific clues or signals." It's like telling the detective to ignore certain types of information.

3. Filtering Out Unwanted Stuff:

   • Imagine you're sorting through mail. Blacklisting is like throwing away letters from certain senders you don't want to hear from.

4. Improving Focus:

   • By blacklisting EventCodes, you're helping your computer focus on the events that matter and ignoring the ones that don't.

5. Less Noise, More Clarity:

   • It's like reducing background noise so you can hear the important stuff clearly. Blacklisting helps your computer concentrate on significant events.

[Bo3432]

I know the purpose of blacklist