Splunk Search

Inputs.conf blacklist with a negative regex

rafadvega
Path Finder

Hello,

I need to create a whitelist with the blacklist. I mean...

I have three blacklist in the windows security input:

[WinEventLog://Security]
disabled=0
index = wineventlog
source = XmlWinEventLog:Security
sourcetype = XmlWinEventLog
...
...
...
blacklist = 4624,4625,2222
blacklist1 = EventCode="4688" $XmlRegex="<Data Name='NewProcessName'>(C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe)|(C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe)|(C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe)|(C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe)|(C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe)|(C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe)</Data>"
blacklist2 = EventCode="1111" $XmlRegex="<Data Name='CallerProcessName'>C:\\ProgramData\\random\\andom2\\dasdfa.exe</Data>"

I need to add another blacklist like this:

blacklist3 = EventCode="4663" $XmlRegex="<Data Name='ProcessName'>(C:\\Windows\\System32\\Taskmgr.exe)</Data>"

This blacklist remove all 4663 events with the processname Taskmgr.exe (works). But actually, I want to remove all 4663 events except, 4663 events with the process name Taskmgr.exe

I tried to use an expression like this, but it isn't work:

blacklist3 = EventCode="4663" $XmlRegex="<Data Name='ProcessName'>(?!C:\\Windows\\System32\\Taskmgr.exe)</Data>"
blacklist3 = EventCode="4663" $XmlRegex="<Data Name='ProcessName'>?!(C:\\Windows\\System32\\Taskmgr.exe)</Data>"
blacklist3 = EventCode="4663" $XmlRegex="<Data Name='ProcessName'>^((?!C:\\Windows\\System32\\Taskmgr.exe)[\s\S])*$</Data>"

Has it a solution? I can't use a whitelist because I have blacklists.

Thanks a lot!

xavierashe
Contributor

Try this regex:

<Data Name='ProcessName'>((?!C:\\Windows\\System32\\Taskmgr.exe).)*$
0 Karma

vansicklj
Loves-to-Learn Lots

I got your regex to match by swapping "?!" for "!?",  adding a delimiter to ".exe", and removing a pair of parentheses:

<Data Name='ProcessName'>(!?(C:\\Windows\\System32\\Taskmgr\.exe)).*$

See https://regex101.com/r/vGIN1P/1

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What makes you think you can't use a whitelist? There is nothing in the documentation that says you can't use both white and black lists.

---
If this reply helps you, Karma would be appreciated.
0 Karma

rafadvega
Path Finder

Thanks for answering. I tried this also:

[WinEventLog://Security]
disabled=0
index = wineventlog
source = XmlWinEventLog:Security
sourcetype = XmlWinEventLog
...
...
...
whitelist= EventCode="4663" $XmlRegex="(C:\Windows\System32\Taskmgr.exe)"
blacklist = 4624,4625,2222
blacklist1 = EventCode="4688" $XmlRegex="(C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe)|(C:\Program Files\SplunkUniversalForwarder\bin\btool.exe)|(C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe)|(C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe)|(C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe)|(C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe)"
blacklist2 = EventCode="1111" $XmlRegex="C:\ProgramData\random\andom2\dasdfa.exe"

But it isn't work. When I add the whitelist, all security events are filtered...

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...