What would be the proper way to push an authentication.conf from the deployer and have the bind password not left in clear text? Is it possible to push the authentication from the deployer without the bind password  and then add another authentication.conf manually to each search head in system local with only the bind password in the stanza? After restart of the search head cluster I’m thinking the bind password would then be encrypted? Would this be the proper way to do this? Would appreciate any other suggestions.  ... View more

Hello, I am trying to blacklist winevent code 4679 by   TaskCategory=Kerberos Service Ticket Operations.  This regex is not working.  blacklist7 = EventCode="4769" TaskCategory="\w+\s\w+\s\w+\s\w+" Ive also tried  blacklist7 = EventCode="4769" TaskCategory="Kerberos Service Ticket Operations" ... View more