Nice windows event blacklisting

inputs.conf

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)"
blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)"
blacklist3 = EventCode="4688" Message="New Process Name:\s*(?i)(?:[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk\-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi|optimize))\.exe)"
blacklist4 = EventCode="4689" Message="Process Name:\s*(?i)(?:[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk\-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi|optimize))\.exe)"

Updated to include the termination of processes (4689)

Note, a lot of this is from other sources, like RF, and the Windows Splunk Logging Cheatsheet.

Updated blacklist1 and blacklist2, as they were overfiltering. Thanks Brandon!

There is another way to configure not using blacklist filter.
If you not want REG-MON, WMI-MON,AD-MON,PERFMON and etc.. just disable it's function.

inputs.conf

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5

[perfmon]
interval = -1
[powershell]
interval = -1
[powershell2]
interval = -1
[admon]
interval = -1
[WinRegMon]
interval = -1
[WinNetMon]
interval = -1
[MonitorNoHandle]
interval = -1
[WinPrintMon]
interval = -1

Added the |optimize to cover Windows indexers running the splunk-optimize.exe process.

Since splunk is limited to 10 blacklists for Windows TA here is how I consolidated a few lines...

blacklist1 = EventCode="(4662|566)" Message="Object Type:(?!\s*groupPolicyContainer)"
blacklist2 = EventCode="(4656|4670|4663|4703|4658|4688)" Message="Account Name:(\W+\w+$)"
blacklist3 = EventCode="4624" Message="An account was successfully logged on"
blacklist4 = EventCode="(4688|4689)" Message="%SplunkUniversalForwarder%"
blacklist5 = EventCode="6278" Message="Network Policy Server granted full access to a user because the host met the defined health policy."

I wanted to ask where you are filtering the powershell wouldn't you want to leave that in case someone tried to run scripts via powershell?

I wanted to ask where you are filtering the powershell wouldn't you want to leave that in case someone tried to run scripts via powershell?

This is blacklisting events for powershell that is run from the path "[C-F]:\Program Files\SplunkUniversalForwarder\bin" which would be scripts run by Splunk UF.

edit: changed drive letter to match regex C-F