You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
30 lines
854 B
30 lines
854 B
[WinEventLog://Security]
|
|
disabled = 0
|
|
evt_resolve_ad_obj = 1
|
|
checkpointInterval = 5
|
|
blacklist1 = EventCode="4662" Message="Object Type:\s+(?!groupPolicyContainer)"
|
|
blacklist2 = EventCode="566" Message="Object Type:\s+(?!groupPolicyContainer)"
|
|
blacklist3 = EventCode="4688" Message="New Process Name: (?i)(?:[C-F]:\Program Files\Splunk(?:UniversalForwarder)?\bin\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi)).exe)"
|
|
index = oswinsec
|
|
|
|
[WinEventLog://Application]
|
|
disabled = 0
|
|
checkpointInterval = 5
|
|
index = oswin
|
|
|
|
[WinEventLog://System]
|
|
disabled = 0
|
|
checkpointInterval = 5
|
|
index = oswin
|
|
|
|
[monitor://$WINDIR\WindowsUpdate.log]
|
|
disabled = 0
|
|
sourcetype = WindowsUpdateLog
|
|
index = oswinsec
|
|
|
|
[WinHostMon://Service]
|
|
interval = 3600
|
|
disabled = 0
|
|
type = Service
|
|
index = oswinscript
|