All,

Hopefully an easy question.

I am currently collecting Windows event logs on a dedicated forwarding server (using native WEF) in a dedicated event log (named “Forwarded Events”).  I have NxLog installed on this server and logs are being sent properly to my SIEM.

Currently I am having difficulties filtering events where the SubjectUserName field ends with “$” symbol (logs are still reaching my SIEM). 

Below is a snippet of my configuration.  I am running NXLog Enterprise version 6.2.

Please advise.

<Extension json>
   Module xm_json
</Extension>
<Input windows_security_eventlog>
Module  im_msvistalog
ReadFromLast True
SavePos True
<QueryXML>
<QueryList>
<Query Id="0">
<Select Path="ForwardedEvents">*</Select>
</Query>
</QueryList>
</QueryXML>
<Exec>
###################################################
#  Drop noisy machine object access (4662) events.#
###################################################
if $EventID == 4662 AND ($SubjectUserName =~ /(.)$/) drop();
</Exec>
</Input>