drop.conf

# Author: Justin Henderson
# Email: jhenderson@tekrefresh.comes
# Last Update: 11/18/2015
#
# This configuration file is designed to look for and drop logs that are unwanted
filter {
  # This section is for dropping logs related to Windows events
  if [type] == "windows" {
    # This drops logs that are related to the use of the Backup privilege.  This is high volume for little gain.
	# However, the backup privilege is used to read any file so you may want this.  Just beware of the volume.
    if [PrivilegeList] =~ "SeBackupPrivilege" {
      drop {}
    }
    if [EventID] == 5447 {
      drop {}
    }
    if [EventID] == 5158 {
      if [Application] =~ "System" {
        drop {}
      }
      if [Application] =~ "svchost.exe" {
        drop {}
      }
      if [Application] =~ "iexplore.exe" {
        drop {}
      }
      if [Application] =~ "lsass.exe" {
        drop {}
      }
      if [Application] =~ "spoolsv.exe" {
        drop {}
      }
      if [Application] =~ "wmiprvse.exe" {
        drop {}
      }
      if [Application] =~ "taskhost.exe" {
        drop {}
      }
      if [Application] =~ "frameworkservice.exe" {
        drop {}
      }
      if [Application] =~ "nxlog.exe" {
        drop {}
      }
      if [Application] =~ "mcafee" {
        drop {}
      }
      if [Application] =~ "kace" {
        drop {}
      }
      if [Application] =~ "mdnsresponder.exe" {
        drop {}
      }
      if [Application] =~ "communicator.exe" {
        drop {}
      }
      if [Application] =~ "ptclient.exe" {
        drop {}
      }
    }
    if [EventID] == 861 {
      drop {}
    }
  }
}