Filtering out "managed service accounts"

Elastic Stack Kibana
1

Hi,

  • Running ELK 6.8.9 on premises

I am trying to add a filter for a visualization that removes events containing "managed service accounts" (accounts ending in $ ) like "GKDG0C3$".

Solution provided in the following post did not work for me (perhaps for a different version of Kibana):

The following post never got an answer for the same issue:

I have also tried adding the expression .*\$, but that did not work either.

Maybe using processors on the client side could be an option as described in the post:

But I haven't had any luck with processors:

My goal is to filter out all events where:

  • event_data.TargetUserName: GKDG0C3$
  • event_data.SubjectUserName: GKDG0C3$

Must be a regular expression and not an exact match, because system accounts are not the same in all systems

Any help would be appreciated.

Thanks

2

Hi,

Any other idea to resolve this. Please help.

Thank you

3

Somebody from @Elastic Team (or a regular user) that could please help me to resolve the issue I am experiencing with Kibana filters?

Thank you

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.