From b314066e06bb4959441e4abc94a6f3f6eee6c218 Mon Sep 17 00:00:00 2001
From: Chris Long <clong@cl0ng.com>
Date: Sat, 2 May 2020 22:20:48 -0700
Subject: [PATCH] Fixing Splunk regex

---
 Vagrant/resources/splunk_server/transforms.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Vagrant/resources/splunk_server/transforms.conf b/Vagrant/resources/splunk_server/transforms.conf
index 5e76d4c..abdd80a 100644
--- a/Vagrant/resources/splunk_server/transforms.conf
+++ b/Vagrant/resources/splunk_server/transforms.conf
@@ -20,11 +20,11 @@ DEST_KEY = queue
 FORMAT = nullQueue
 
 [osqueryd_wineventlog_null]
-REGEX = "Process_Name=C:\\Program Files\\osquery\\osqueryd\\osqueryd.exe"
+REGEX = "Process\sName:\s+C:\\Program Files\\osquery\\osqueryd\\osqueryd.exe""
 DEST_KEY = queue
 FORMAT = nullQueue
 
 [autoruns_wineventlog_null]
 REGEX = "Script\sName\s=\sC\:\\Program Files\\AutorunsToWinEventLog\\AutorunsToWinEventLog.ps1"
 DEST_KEY = queue
-FORMAT = nullQueue
\ No newline at end of file
+FORMAT = nullQueue