I've done some reading in Winlogbeat's documentation and wanted to confirm the syntax of a processor that I'm trying to implement.
I have a noisy event that I want to drop before it makes it to Logstash --> Elasticsearch --> Kibana. Here's the query I use in Kibana to pull the events:
event_data.ProcessName: "*Scan64.Exe" AND event_id: "4656"
event_data.ProcessName: "*mcshield.exe" AND event_id: "4663"
I believe the structure of the processor should look something like this:
processors: - drop_event: when: equals: event_data.ProcessName: ["Scan64.Exe"] equals: event_id: ["4656"]
processors: - drop_event: when: equals: event_data.ProcessName: ["mcshield.exe"] equals: event_id: ["4663"]
Does this look like the correct syntax to drop both of the conditions that I described above?
Thank you in advance for your help!