Implementing blacklist on wef_inputs.conf

Resolving Issue #436
2020-05-03 17:08:22 -07:00
1 parent f0a7b1481f
commit 9e9120f02b
@@ -140,6 +140,7 @@ disabled = 0
 start_from = oldest
 current_only = 0
 checkpointInterval = 5
+blacklist1 = EventCode="4798" Message=".+Process Name:.+\\osqueryd\\osqueryd.exe"

 [WinEventLog://WEC3-Windows-Diagnostics]
 sourcetype = WinEventLog:System