Splunk Enterprise Security

Discarding Specific type of traffic either on forwarder or indexer fails

abwe
New Member

Discarding Specific type of traffic either on forwarder or indexer fails, I tried to discard it using blacklist on forwarder and nullqueue transform on indexer and both failed.

here is a log sample

Oct 3 11:34:03 1.1.1.1 CEF:0|FORCEPOINT|Firewall|6.5.1|70018|Connection_Allowed|0|app=SNMP (UDP) rt=Oct 03 2019 11:28:12 deviceFacility=Packet Filtering act=Allow deviceOutboundInterface=13 deviceInboundInterface=0 proto=17 dpt=161 spt=62032 dst=2.2.2.2 src=3.3.3.3 dvchost=4.4.4.4 dvc=4.4.4.4 deviceExternalId=company-name node 1 cs1Label=RuleID cs1=2097272.10

and the configuration

props.conf
[forcepoint]
Transform-Forcepoint=discardsnmp

transforms.conf
[discardsnmp]
REGEX = app=SNMP
DEST_KEY = queue
FORMAT = nullQueue

any one can find out what is the problem?

0 Karma
1 Solution

ivanreis
Builder

please try this one: https://regex101.com/r/wgNicw/1

transforms.conf
[discardsnmp]
REGEX = \b(\w[a-zA-Z].*\Dapp=SNMP.+)
DEST_KEY = queue
FORMAT = nullQueue

View solution in original post

0 Karma

ivanreis
Builder

please try this one: https://regex101.com/r/wgNicw/1

transforms.conf
[discardsnmp]
REGEX = \b(\w[a-zA-Z].*\Dapp=SNMP.+)
DEST_KEY = queue
FORMAT = nullQueue

View solution in original post

0 Karma

abwe
New Member

Thanks, it worked like charm

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!