trinitor/DetectionLab
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #427 from clong/nullqueue2

Browse Source 
Add some Splunk nullQueues for noisy events
This commit is contained in:
Chris Long
2020-04-18 16:00:50 -07:00
committed by GitHub
parent c238b8e21f d1d0566773
commit 78130b2b78
2 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
Vagrant/resources/splunk_server/props.conf
View File

@@ -21,4 +21,8 @@ TIME_FORMAT = %s
TRUNCATE = 0 TRUNCATE = 0
[osquery:status] [osquery:status]
TRANSFORMS-null = setnull TRANSFORMS-null = setnull
[WinEventLog]
TRANSFORMS-null = osqueryd_wineventlog_null
TRANSFORMS-null = autoruns_wineventlog_null

10
Vagrant/resources/splunk_server/transforms.conf
View File

@@ -17,4 +17,14 @@ FORMAT = host::$1
[setnull] [setnull]
REGEX = Error\scasting REGEX = Error\scasting
DEST_KEY = queue DEST_KEY = queue
FORMAT = nullQueue
[osqueryd_wineventlog_null]
REGEX = "Process_Name=C:\\Program Files\\osquery\\osqueryd\\osqueryd.exe"
DEST_KEY = queue
FORMAT = nullQueue
[autoruns_wineventlog_null]
REGEX = "Script\sName\s=\sC\:\\Program Files\\AutorunsToWinEventLog\\AutorunsToWinEventLog.ps1"
DEST_KEY = queue
FORMAT = nullQueue FORMAT = nullQueue