Auditbeat Exclusion of Process

Elastic Stack Beats
1

Hi All,

Could someone help me with exclude any process executable related to this path

/usr/local/manageengine/uems_agent/bin/*

(I can see a lot of incoming logs related to

/usr/local/manageengine/uems_agent/bin/dcpatchscan

/usr/local/manageengine/uems_agent/bin/dcconfig

/usr/local/manageengine/uems_agent/bin/dcservice

/usr/local/manageengine/uems_agent/bin/dcinventory

/usr/local/manageengine/uems_agent/bin/dcondemand

appreciate your help!

2

Hello @testtest

Welcome to the Community!!

We can use drop_event in the yaml :

Example :

Thanks!!