diff --git a/Vagrant/resources/splunk_forwarder/wef_inputs.conf b/Vagrant/resources/splunk_forwarder/wef_inputs.conf
index 35651dd..7690af9 100755
--- a/Vagrant/resources/splunk_forwarder/wef_inputs.conf
+++ b/Vagrant/resources/splunk_forwarder/wef_inputs.conf
@@ -140,6 +140,7 @@ disabled = 0
 start_from = oldest
 current_only = 0
 checkpointInterval = 5
+blacklist1 = EventCode="4798" Message=".+Process Name:.+\\osqueryd\\osqueryd.exe"
 
 [WinEventLog://WEC3-Windows-Diagnostics]
 sourcetype = WinEventLog:System