trinitor/DetectionLab
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #456 from clong/osquery_status_filter

Browse Source 
Filter noisy osquery status info messages from Splunk
This commit is contained in:
Chris Long
2020-06-01 21:48:23 -07:00
committed by GitHub
parent da366bcce6 2823f140d2
commit 1980665355
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
Vagrant/resources/splunk_server/props.conf
View File

@@ -21,7 +21,7 @@ TIME_FORMAT = %s
TRUNCATE = 0 TRUNCATE = 0
[osquery:status] [osquery:status]
TRANSFORMS-null = setnull TRANSFORMS-null = osquery_status_filter
[WinEventLog] [WinEventLog]
TRANSFORMS-null = autoruns_wineventlog_null TRANSFORMS-null = autoruns_wineventlog_null

4
Vagrant/resources/splunk_server/transforms.conf
View File

@@ -14,8 +14,8 @@ DEST_KEY = MetaData:Host
REGEX = hostIdentifier\"\:\"([^\"]+)\" REGEX = hostIdentifier\"\:\"([^\"]+)\"
FORMAT = host::$1 FORMAT = host::$1
[setnull] [osquery_status_filter]
REGEX = Error\scasting REGEX = (POST\srequest\sto\sURI|Refreshing\sconfiguration|not\sattaching|Executing\sscheduled\squery|Error\scasting)
DEST_KEY = queue DEST_KEY = queue
FORMAT = nullQueue FORMAT = nullQueue