From 9e9120f02b2e3c7aee2e618c498b09f8bae1126d Mon Sep 17 00:00:00 2001 From: Chris Long Date: Sun, 3 May 2020 17:08:22 -0700 Subject: [PATCH] Implementing blacklist on wef_inputs.conf Resolving Issue #436 --- Vagrant/resources/splunk_forwarder/wef_inputs.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/Vagrant/resources/splunk_forwarder/wef_inputs.conf b/Vagrant/resources/splunk_forwarder/wef_inputs.conf index 35651dd..7690af9 100755 --- a/Vagrant/resources/splunk_forwarder/wef_inputs.conf +++ b/Vagrant/resources/splunk_forwarder/wef_inputs.conf @@ -140,6 +140,7 @@ disabled = 0 start_from = oldest current_only = 0 checkpointInterval = 5 +blacklist1 = EventCode="4798" Message=".+Process Name:.+\\osqueryd\\osqueryd.exe" [WinEventLog://WEC3-Windows-Diagnostics] sourcetype = WinEventLog:System