ver 5.1.1
I have the below implemented to drop windows events not needed, but am still getting events that should be blocked.
I had previously tried
processors:
- drop_event:
when:
not:
equals:
event_id: 1102 OR 4618 OR 4624 OR 4625 OR 4648 OR 4649 OR 4657 OR 4672 OR 4692 OR 4693 OR 4694 OR 4706 OR 4714 OR 4724 OR 4735 OR 4740 OR 4892 OR 4896 OR 4897 OR 4963 OR 4964 OR 4964 OR 5030 OR 5124 OR 6272 OR 6273 OR 6274 OR 6275 OR 6276 OR 6277 OR 6278 OR 6279 OR 6280 OR 10028
but this did not seem to work.
###################### Winlogbeat Configuration Example ##########################
# This file is an example configuration file highlighting only the most common
# options. The winlogbeat.full.yml file from the same directory contains all the
# supported options with more comments. You can use it as a reference.
#
# You can find the full configuration reference here:
# https://www.elastic.co/guide/en/beats/winlogbeat/index.html
#======================= Winlogbeat specific options ==========================
# event_logs specifies a list of event logs to monitor as well as any
# accompanying options. The YAML data type of event_logs is a list of
# dictionaries.
#
# The supported keys are name (required), tags, fields, fields_under_root,
# forwarded, ignore_older, level, event_id, provider, and include_xml. Please
# visit the documentation for the complete details of each option.
# https://go.es.io/WinlogbeatConfig
winlogbeat.event_logs:
- name: Application
#ignore_older: 72h
- name: Security
- name: System
#================================ General =====================================
# The name of the shipper that publishes the network data. It can be used to group
# all the transactions sent by a single shipper in the web interface.
#name:
# The tags of the shipper are included in their own field with each
# transaction published.
#tags: ["service-X", "web-tier"]
# Optional fields that you can specify to add additional information to the
# output.
#fields:
# env: staging
#================================ Outputs =====================================
# Configure what outputs to use when sending the data collected by the beat.
# Multiple outputs may be used.
#-------------------------- Elasticsearch output ------------------------------
#output.elasticsearch:
# Array of hosts to connect to.
#hosts: ["localhost:9200"]
# Optional protocol and basic auth credentials.
#protocol: "https"
#username: "elastic"
#password: "changeme"
#----------------------------- Logstash output --------------------------------
output.logstash:
# The Logstash hosts
hosts: ["xxx.xx.xxx.xxx:xxxx"]
# Optional SSL. By default is off.
# List of root certificates for HTTPS server verifications
#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
# Certificate for SSL client authentication
#ssl.certificate: "/etc/pki/client/cert.pem"
# Client Certificate Key
#ssl.key: "/etc/pki/client/cert.key"
#================================ Logging =====================================
# Sets log level. The default log level is info.
# Available log levels are: critical, error, warning, info, debug
#logging.level: critical
# At debug level, you can selectively enable logging only for some components.
# To enable all selectors use ["*"]. Examples of other selectors are "beat",
# "publish", "service".
#logging.selectors: ["*"]
processors:
- drop_event:
when:
equals:
event_id: 512 OR 513 OR 514 OR 515 OR 516 OR 517 OR 518 OR 519 OR 520 OR 521 OR 528 OR 529 OR 530 OR 531 OR 532 OR 533 OR 534 OR 535 OR 536 OR 537 OR 538 OR 539 OR 540 OR 551 OR 552 OR 560 OR 561 OR 562 OR 563 OR 564 OR 565 OR 566 OR 567 OR 576 OR 577 OR 578 OR 592 OR 593 OR 594 OR 595 OR 596 OR 600 OR 601 OR 602 OR 608 OR 609 OR 610 OR 611 OR 612 OR 613 OR 614 OR 615 OR 616 OR 617 OR 618 OR 619 OR 620 OR 621 OR 622 OR 623 OR 624 OR 625 OR 626 OR 627 OR 628 OR 629 OR 630 OR 631 OR 632 OR 633 OR 634 OR 635 OR 636 OR 637 OR 638 OR 639 OR 640 OR 641 OR 642 OR 643 OR 644 OR 645 OR 646 OR 647 OR 648 OR 649 OR 650 OR 651 OR 652 OR 653 OR 654 OR 655 OR 656 OR 657 OR 658 OR 659 OR 660 OR 661 OR 662 OR 663 OR 664 OR 665 OR 666 OR 667 OR 668 OR 669 OR 670 OR 671 OR 672 OR 673 OR 674 OR 675 OR 676 OR 677 OR 678 OR 679 OR 680 OR 681 OR 682 OR 683 OR 684 OR 685 OR 686 OR 687 OR 688 OR 689 OR 690 OR 691 OR 692 OR 693 OR 694 OR 695 OR 696 OR 697 OR 806 OR 807 OR 808 OR 809 OR 848 OR 849 OR 850 OR 851 OR 852 OR 853 OR 854 OR 855 OR 856 OR 857 OR 858 OR 859 OR 860 OR 861 OR 1100 OR 1101 OR 1104 OR 1105 OR 1108 etc