CODEWITHSUNDEEP
xmlwindowsxpathwinrm
laxurent
laxurent

Reputation: 75

Trying to understand XPATH Filtering for Windows Event Logs (XML)

So right now I am trying to set up and configure Windows Event Collection by using a Collector Initiated Subscription. Currently, I am only collecting Security Event Logs 4624 and 4688. I'm seeing a lot of noise from just random accounts that log into the boxes for certain purposes. I wanted to figure out a way to filter out these specific account names so the subscription service ignores them.

Current XML file is:

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">*[System[(EventID=4624 or EventID=4688)]]</Select>
  </Query>
</QueryList>

Event Log XML is the below. But I don't want my Windows Event Collector to collect any logs that have "0xluka" in the "Target User Name" field.

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event" xml:lang="en-US"> 
- <System> 
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="" /> 
<EventID>4624</EventID> 
<Version>2</Version> 
<Level>0</Level> 
<Task>12544</Task> 
<Opcode>0</Opcode> 
<Keywords>0x8020000000000000</Keywords> 
<TimeCreated SystemTime="2019-10-23T20:19:06.533771900Z" /> 
<EventRecordID>963937830</EventRecordID> 
<Correlation ActivityID="" /> 
<Execution ProcessID="640" ThreadID="15576" /> 
<Channel>Security</Channel> 
<Computer>0xluka.localdomain.com</Computer> 
<Security /> 
</System> 
- <EventData> 
<Data Name="SubjectUserSid"></Data> 
<Data Name="SubjectUserName">-</Data> 
<Data Name="SubjectDomainName">-</Data> 
<Data Name="SubjectLogonId">0x0</Data> 
<Data Name="TargetUserSid"></Data> 
<Data Name="TargetUserName">0xluka</Data> 
<Data Name="TargetDomainName"></Data> 
<Data Name="TargetLogonId"></Data> 
<Data Name="LogonType">3</Data> 
<Data Name="LogonProcessName">NtLmSsp</Data> 
<Data Name="AuthenticationPackageName">NTLM</Data> 
<Data Name="WorkstationName"></Data> 
<Data Name="LogonGuid"></Data> 
<Data Name="TransmittedServices">-</Data> 
<Data Name="LmPackageName">NTLM V2</Data> 
<Data Name="KeyLength">0</Data> 
<Data Name="ProcessId">0x0</Data> 
<Data Name="ProcessName">-</Data> 
<Data Name="IpAddress"></Data> 
<Data Name="IpPort"></Data> 
<Data Name="ImpersonationLevel">%%1833</Data> 
<Data Name="RestrictedAdminMode">-</Data> 
<Data Name="TargetOutboundUserName">-</Data> 
<Data Name="TargetOutboundDomainName">-</Data> 
<Data Name="VirtualAccount">%%1843</Data> 
<Data Name="TargetLinkedLogonId">0x0</Data> 
<Data Name="ElevatedToken">%%1842</Data> 
</EventData> 
- <RenderingInfo Culture="en-US"> 
<Message>An account was successfully logged on. </Message> 
<Level>Information</Level> 
<Task>Logon</Task> 
<Opcode>Info</Opcode> 
<Channel>Security</Channel> 
<Provider>Microsoft Windows security auditing.</Provider> 
- <Keywords> 
<Keyword>Audit Success</Keyword> 
</Keywords> 
</RenderingInfo> 
</Event>

Upvotes: 1

Views: 3663

Answers (1)

Ed Bangga
Ed Bangga

Reputation: 13016

you can exclude this targetusername by adding another condition to your existing xpath.

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">*[System[(EventID=4624 or EventID=4688)]] and
         *[EventData[Data[@Name='TargetUserName'] and (Data!='0xluka')]]    
    </Select>
  </Query>
</QueryList>

Upvotes: 2

Related Questions