Skip to content

Instantly share code, notes, and snippets.

@animetauren

animetauren/Splunk Ingest Action Filter for Windows Event Logs Secret

Last active December 14, 2023 15:52
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save animetauren/afddab3a2aff30526f6032766542ad22 to your computer and use it in GitHub Desktop.
Save animetauren/afddab3a2aff30526f6032766542ad22 to your computer and use it in GitHub Desktop.
Download ZIP
Regex to filter Windows Event Logs using Splunk Ingest Actions
Raw
Splunk Ingest Action Filter for Windows Event Logs
[source::WinEventLog:System]
ingest_action_replace_info_text_from_winsecurity_events_this_event = This\sevent\sis\sgenerated[\r\n\t\S\s]*
[source::WinEventLog:Security]
ingest_action_replace_info_text_from_null_sid_id = (Security\sID:\s\sNULL\sSID)|(Logon\sID:\s\s0x0)
ingest_action_replace_cleansrcip = Source\sNetwork\sAddress:\s(::1|127.0.0.1)
ingest_action_replace_cleansrcport = Source\sPort:\s*0
ingest_action_replace_remove_ffff = ::ffff:
ingest_action_replace_info_text_from_winsecurity_events_certificate_information = Certificate\sinformation\sis\sonly[\r\n\t\S\s]*
ingest_action_replace_info_text_from_winsecurity_events_token_elevation_type = Token\sElevation\sType\sindicates[\r\n\t\S\s]*Run\sas\sadministrator\.$
ingest_action_replace_info_text_from_winsecurity_events_this_event = This\sevent\sis\sgenerated[\r\n\t\S\s]*
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment