Splunk Search

Unable to blacklist Windows events with regex on universal forwarder

Explorer

Hi All,

We have an remote DC, to save bandwidth and Splunk license we like to filter out computer account logon messages.
Using Splunk UFW 6.2.4
EventCode=4624
Example eventlog message:

An account was successfully logged on. Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: NT AUTHORITY\SYSTEM Account Name: DC01$ Account Domain: AAA-BBB Logon ID: 0x2d71a99b Logon GUID: .......

Account Name is listed twice, if the second Account Name directive is an computer account (ending with a $) the event should be blacklisted and not forwarded to the indexer.

I added the following to the inputs.conf in de deployment-apps/Splunk_TA_windows/local:

blacklist3 = EventCode="4624" Message="Account\sName:\s.*Account\sName:\s(\S+\$)"

Why is this not working? Tested the regex on https://regex101.com/ and it looks fine?
Blacklisting just EventCode="4624" is working fine but that’s not what we want.

Also tried the following, all not working while regex101 shows the regex is ok.

blacklist3 = EventCode="4624" Message="(?:.*?Account Name:){2}\s(\S+)\$"
blacklist3 = EventCode="4624" Message="Account Name:\s(\S+).+Account Name:\s(\S+)\$"
blacklist3 = EventCode="4624" Message="Account\sName:.*Account\sName:\s[\S+]+[\$]"

Thanks in advance,

1 Solution

SplunkTrust
SplunkTrust

One problem I see is that you are specifying a single space between "Account Name:" and whatever comes after, but in all my windows event logs I have multiple spaces between "Account Name" and the account name.

So
Account\sName:.*Account\sName:\s[\S+]+[\$] might need to be
Account\sName:.*Account\sName:\s+[\S+]+[\$]. Can you give that a try on some of your examples and see if it helps?

If it doesn't, try limiting your blacklist to either/any of the "Account Name:" ending in $ being blocked, get that working and it should be a simple matter to extend it to the second one.

And, otherwise, post back with whatever new revelations you've had from those!

View solution in original post

SplunkTrust
SplunkTrust

One problem I see is that you are specifying a single space between "Account Name:" and whatever comes after, but in all my windows event logs I have multiple spaces between "Account Name" and the account name.

So
Account\sName:.*Account\sName:\s[\S+]+[\$] might need to be
Account\sName:.*Account\sName:\s+[\S+]+[\$]. Can you give that a try on some of your examples and see if it helps?

If it doesn't, try limiting your blacklist to either/any of the "Account Name:" ending in $ being blocked, get that working and it should be a simple matter to extend it to the second one.

And, otherwise, post back with whatever new revelations you've had from those!

View solution in original post

Explorer

Thanks for your fast response.

You pointed me in the right direction.
I tested my regex against the consolidated message field, not the original Windows Eventlog Message.
The original Eventlog Message contains tabs and newline chars.

An account was successfully logged on.

    Subject:
        Security ID:        NULL SID
        Account Name:       -
        Account Domain:     -
        Logon ID:       0x0

    Logon Type:         3

    New Logon:
        Security ID:        SYSTEM
        Account Name:       DC01$
        Account Domain:     AAA-BBB
    ....

Solved it with the following regex blacklist entry:

blacklist3 = EventCode="4624" Message="Account\sName:.*[\S\s]*Account\sName:\s+[\S+]+[\$]"
0 Karma

Explorer

Derksr,

I tried your regex blacklist entry but it did it not work... did it work for you? Here is how mine look:

blacklist3 = Eventcode="^4624" Message="^Logon\sType:\s+[3]" Message=".*Account\sName:.*[\S\s]*Account\sName:\s+[a-zA-Z0-9-]+[\$]"
0 Karma

Explorer

Yes mine worked great.

I've checked your regex with https://www.regex101.com/#python (did you?)
The following works for me:

Message="Account\sName:.*[\S\s]*Logon\sType:\s+[3][\S\s]*Account\sName:\s+[\S+]+[\$]"

So 1 message directive.

Looks like the following is what you want: (watch out for capitals EventCode != Eventcode )

blacklist3 = EventCode="4624" Message="Account\sName:.*[\S\s]*Logon\sType:\s+[3][\S\s]*Account\sName:\s+[\S+]+[\$]"

Explorer

Derksr,

You were right on point... I typed eventcode rather than EventCode. It seems to be working!

Thanks!

0 Karma