Skip to content

Instantly share code, notes, and snippets.

@christian-taillon

christian-taillon/inputs.conf

Forked from automine/inputs.conf
Created January 6, 2023 21:35
Show Gist options
  • Save christian-taillon/2b4b5f1e24b94c3d50ff29eaa3deb70d to your computer and use it in GitHub Desktop.
Save christian-taillon/2b4b5f1e24b94c3d50ff29eaa3deb70d to your computer and use it in GitHub Desktop.
Download ZIP
Nice windows event blacklisting
Raw
inputs.conf
[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)"
blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)"
blacklist3 = EventCode="4688" Message="New Process Name:\s*(?i)(?:[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk\-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi|optimize))\.exe)"
blacklist4 = EventCode="4689" Message="Process Name:\s*(?i)(?:[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk\-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi|optimize))\.exe)"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment