Merge branch 'master' into update_gpo_ena

2020-05-03 17:13:59 -07:00
parent aeecd1b756 9e9120f02b
commit 23e8e288f9
2 changed files with 2 additions and 1 deletions
--- a/Vagrant/resources/splunk_forwarder/wef_inputs.conf
+++ b/Vagrant/resources/splunk_forwarder/wef_inputs.conf
@@ -140,6 +140,7 @@ disabled = 0
 start_from = oldest
 current_only = 0
 checkpointInterval = 5
+blacklist1 = EventCode="4798" Message=".+Process Name:.+\\osqueryd\\osqueryd.exe"

 [WinEventLog://WEC3-Windows-Diagnostics]
 sourcetype = WinEventLog:System
--- a/Vagrant/resources/splunk_server/transforms.conf
+++ b/Vagrant/resources/splunk_server/transforms.conf
@@ -22,4 +22,4 @@ FORMAT = nullQueue
 [autoruns_wineventlog_null]
 REGEX = "Script\sName\s=\sC\:\\Program Files\\AutorunsToWinEventLog\\AutorunsToWinEventLog.ps1"
 DEST_KEY = queue
-FORMAT = nullQueue
+FORMAT = nullQueue