Droping winlog.event_data.LogonType: "3"

Elastic Stack Beats
1

Hello,
Starting with ELK ,I'm trying to drop the following event without success
winlog.event_data.LogonType: "3"
Can someone help?

- name: Security
 ignore_older: 24h
 event_id: 4624, 4625, 7045, 4758, 4743, 4734, 4730, 4726, 4648, 4776, 4768, 1102, 106, 4662, 
 4728, 4729, 4672, 4767, 4740
 processors:
 - drop_event.when:
    and:
    - equals.event_id: 4624
    - equals.winlog.event_data.LogonType: "3"'
2

Hey @kubekpk,

I think the condition for event_id should be equals.winlog.event_id: 4624, as the event_id field is under a winlog object.

You can take a look to this topic, where a similar configuration is discussed: Filter system logons

3

Thx.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.