Hi! Using ELK 7.10 Tried different terms but result always go through
My winlogbeat.yml:
......
'- name: Windows PowerShell
event_id: 400, 403, 600, 800
processors:
- drop_event.when.or:
- regexp.process.command_line.text: 'zabbix'
- regexp.process.args: 'zabbix'
- script:
lang: javascript
.......
Event with expected as dropped:
process.args = powershell.exe,-File, C:\zabbix\Discovery.mssql.ps1, JSONJOBNAME
process.args_count = 7
process.command_line = powershell.exe -File C:\zabbix\Discovery.mssql.ps1 JSONJOBNAME.
I just want to drop all events with "zabbix" in it. What can be wrong?