Splunk Search

Regex to filter security events does'nt work, need help

Communicator

Hi Guys,

We have UFs on our DCs and 2 indexers and on both indexers, to drop the unwanted text from events

I tried using the following regex in the /opt/splunk/etc/slave-apps/Splunk_TA_windows/local/props.conf

[WinEventLog:Security] SEDCMD-shortern4624 = SEDCMD-shortern4624 = s/(?mis)(.EventCode=4624.)This event is generated when a logon session.*$/\1/g

it does not work

0 Karma

Revered Legend

The SEDCMD is used for data masking (or in some cases editing) before indexing. For other log types you would, to drop the whole events which matches your regular expression, you would use Transforms (http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Routeandfilterdatad#Discard_specific_ev...), but for Event Logs, you could just use blacklist attribute in inputs.conf on the Universal forwarder. See these

https://answers.splunk.com/answers/152131/filter-windows-eventcode-using-blacklist-and-whitelist.htm...
http://docs.splunk.com/Documentation/Splunk/7.0.0/Data/MonitorWindowseventlogdata#Create_advanced_fi...

0 Karma

Communicator

I do not want to drop the whole event i just want to drop the static text that gives the description about the event.

I am referring to this link https://www.splunk.com/blog/2012/09/21/the-splunk-app-for-active-directory-and-how-i-tamed-the-secur...

0 Karma

Revered Legend

Ok.. Try this (props.conf on your indexer, you may have to deploy it from cluster master instead of updating the slave-apps directly)

[WinEventLog:Security] 
SEDCMD-shortern4624 = s/(?mis)(.*EventCode=4624.*)This event is generated when a logon session.*$/\1/g
0 Karma

Communicator

yes i am already following the best practice of doing this in master apps and then deploying to slave-apps

Thanks, i used a different regex and this time its working

NOW following is wat i am using in my /opt/splunk/etc/slave-apps/splunk-TA-Windows/local

in props.conf
# message shortener for windows event security
# removes text from message field starting with: This event is generated
[WinEventLog:Security]
TRANSFORM-windows_events = win_event_shortener

in transforms.conf

[win_event_shortener]
DEST_KEY = _raw
REGEX = ((.*+[\v])+)(?=This event is generated)
FORMAT = $1

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!