I attempted to whitelist a user, it isn't working at the moment. This is the xml and in bold is where I attempted to add to create the whitelist. Thank you for any help!
<rule type="REL" version="1.0">
<arguments>
<argument displayname="Event filter" name="Event filter" description="Specifies filter for matching the event." class="Filter">
<value><filter type="EventFilter" version="1.0">
<arguments>
<argument usedefault="true" displayname="Computer" name="Computer" description="Computer where the events were generated." class="List">
<value>"*"</value>
<default description="Any string">"*"</default>
</argument>
<argument usedefault="false" displayname="User" name="User" description="User account the event was generated by." class="List">
<value>""SVC*","This is a large list of users cut down"</value>
<default description="Any string">"*"</default>
</argument>
<argument usedefault="true" displayname="Workstation" name="Workstation" description="Computer on which the logon attempt was performed." class="List">
<value>"*"</value>
<default description="Any string">"*"</default>
</argument>
<argument usedefault="false" displayname="Logon Type" name="Logon Type" description="Type of logon, such as interactive or network." class="RangeList">
<value>"7-7,10-10"</value>
<default description="Any number">"0-4294967295"</default>
</argument>
<argument displayname="Whitelisted Users" name="Whitelisted_Users" class="List" description="A list of users to exclude from monitoring.">
<value>"svcTEST"</value>
</</arguments>
<body>
_DataSourceName="Security" and
in(Computer, "wi", array(<parameter name="Computer"/>) ) and
(
(
not empty( regexp( "Security",Source,"i" ) ) and
in(AccountName, "wi", array(<parameter name="User"/>) ) and not(in(String6, "wi", array(<parameter name="Whitelisted_Users"/>))) and
(
(
in_range(EventID, "528, 540") and
in(String7, "wi", array(<parameter name="Workstation"/>) ) and
in_range(String4, <parameter name="Logon Type"/>)
) or
(
in_range(EventID, "538") and
in_range(String4, <parameter name="Logon Type"/>)
)
)
) or
(
not empty( regexp( "Microsoft-Windows-Security-Auditing",Source,"i" ) ) and
(
(
in_range(EventID, "4634") and
in_range(String5, <parameter name="Logon Type"/>) and
(
in( String2, "wi", array(<parameter name="User"/>) ) or
in( strcat( String3, "\\", String2), "wi", array(<parameter name="User"/>) )
)
) or
(
in_range(EventID, "4624") and
in(String12, "wi", array(<parameter name="Workstation"/>) ) and
in_range(String9, <parameter name="Logon Type"/>) and
(
in( String6, "wi", array(<parameter name="User"/>) ) or
in( strcat( String7, "\\", String6), "wi", array(<parameter name="User"/>) )
)
)
)
)
)
</body>
</filter></value>
</argument>
</arguments>
<prefilter>
<parameter name="Event filter"/>;
</prefilter>
<body>
<parameter name="Event filter"/>;
</body>
</rule>
