We use Splunk for storing and analyzing Windows security events. We now want to start storing firewall events related tot management ports.
I plan to use the following for retrieving the relevant data from the Windows security log
whitelist9 = EventCode="(?:515[67])" Message="(?i)Direction\:\t+Inbound" Message="Destination\sPort\:\t+(135|139|445|3389|5985|5986)"
I would like to store these events using a diiferent source type than the other events from [WinEventLog://Security]
How can I achieve this?
Whg do you specifically want to do this as other sourcetype?
You want to index all the events from that WinEventLog, so you can't do that from the UF inputs.conf.
You need the parser (HF or Indexer) to apply a different treatment for those specific events :
props.conf
[source::TheWindowsSecurityLog]
TRANSFORMS = firewall_only
transforms.conf
[firewall_only]
REGEX = EventCode=515[67]
DEST_KEY = MetaData:SourceType
FORMAT = sourcetype::wineventlog_firewall
The REGEX probably needs some modification, but the spirit is to give a specific redirection for only those events that match the expression.
All the other events will follow the natural process.
No need for a blacklist/whitelist from the UF inputs.conf.