11/02/2021, 2:25 PM
Can someone help me with exclusions vs inclusions and which win. I have win_socket_events running and I am trying to exclude splunk events. I have the port splunk uses in the includeded ports filter but in the process_name section I exclude the splunk process name. Yes in the results I still see splunk process being reported. The only thing I can think of is that INCLUDES trump EXCLUDES and if the include matches then the exclude is ignored. Is this how it works? Or am I doing something completely incorrect.
5:03 PM
Here is an example config that I tried. When this is running I still see the 3 process names in the exclude config being reported. Why would this config not drop the events where the process name matches those in the exclude block.


11/04/2021, 12:02 PM
12:02 PM
Let us test it locally. They syntax/format looks fine to me


11/05/2021, 2:29 PM
here is the output from osqueryd starting in the foreground with the verbose flag


11/07/2021, 8:07 AM
No event_filter found
warning should come only if osquery.conf file you are using does not have