trinitor/DetectionLab
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Filter out Splunk and osqueryd events

Browse Source
This commit is contained in:
Chris Long
2020-08-12 23:01:06 -07:00
committed by GitHub
parent 97c98f332b
commit 0bf5a631fa
1 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
Vagrant/resources/splunk_forwarder/wef_inputs.conf
View File

@@ -59,6 +59,8 @@ disabled = 0
start_from = oldest start_from = oldest
current_only = 0 current_only = 0
checkpointInterval = 5 checkpointInterval = 5
blacklist = Message="(?:Process Name:).+(?:C:\\Program Files\\osquery\\osqueryd\\osqueryd.exe)"
blacklist1 = Message="(?:Process Name:).+(?:C:\\Program Files\\SplunkUniversalForwarder\\bin\\)"
[WinEventLog://WEC-Code-Integrity] [WinEventLog://WEC-Code-Integrity]
sourcetype = WinEventLog:Security sourcetype = WinEventLog:Security
@@ -87,6 +89,16 @@ start_from = oldest
current_only = 0 current_only = 0
checkpointInterval = 5 checkpointInterval = 5
[WinEventLog://WEC2-Object-Manipulation]
sourcetype = WinEventLog:Security
source = WinEventLog:Object-Handle
index=wineventlog
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
blacklist = Message="(?:Process Name:).+(?:osqueryd.exe)"
[WinEventLog://WEC2-Task-Scheduler] [WinEventLog://WEC2-Task-Scheduler]
sourcetype = WinEventLog:Task-Scheduler sourcetype = WinEventLog:Task-Scheduler
source = WinEventLog:Task-Scheduler source = WinEventLog:Task-Scheduler
@@ -140,7 +152,6 @@ disabled = 0
start_from = oldest start_from = oldest
current_only = 0 current_only = 0
checkpointInterval = 5 checkpointInterval = 5
blacklist1 = EventCode="4798" Message=".+Process Name:.+\\osqueryd\\osqueryd.exe"
[WinEventLog://WEC3-Windows-Diagnostics] [WinEventLog://WEC3-Windows-Diagnostics]
sourcetype = WinEventLog:System sourcetype = WinEventLog:System
@@ -412,15 +423,6 @@ start_from = oldest
current_only = 0 current_only = 0
checkpointInterval = 5 checkpointInterval = 5
[WinEventLog://WEC2-Object-Manipulation]
sourcetype = WinEventLog:Security
source = WinEventLog:Object-Handle
index=wineventlog
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
[monitor://c:\pslogs] [monitor://c:\pslogs]
index = powershell index = powershell
sourcetype = powershell_transcript sourcetype = powershell_transcript