Merge pull request #427 from clong/nullqueue2

Add some Splunk nullQueues for noisy events

Vagrant/resources/splunk_server/props.conf

@@ -22,3 +22,7 @@ TRUNCATE = 0
 
 [osquery:status]
 TRANSFORMS-null = setnull
+
+[WinEventLog]
+TRANSFORMS-null = osqueryd_wineventlog_null
+TRANSFORMS-null = autoruns_wineventlog_null

Vagrant/resources/splunk_server/transforms.conf

@@ -18,3 +18,13 @@ FORMAT = host::$1
 REGEX = Error\scasting
 DEST_KEY = queue
 FORMAT = nullQueue
+
+[osqueryd_wineventlog_null]
+REGEX = "Process_Name=C:\\Program Files\\osquery\\osqueryd\\osqueryd.exe"
+DEST_KEY = queue
+FORMAT = nullQueue
+
+[autoruns_wineventlog_null]
+REGEX = "Script\sName\s=\sC\:\\Program Files\\AutorunsToWinEventLog\\AutorunsToWinEventLog.ps1"
+DEST_KEY = queue
+FORMAT = nullQueue