WpnUserService_ discovery on Windows Server 2019

[eglyn]

Hi !

I try to disable random service discovery like this:

WpnUserService_1062e5" (Windows Push Notifications User Service_1062e5) is not running (startup type automatic)

I add ^\A(WpnUserService_|OneSyncSvc_|CDPUserSvc_) in Administration -> General -> Regular Expression, with "Result is FALSE" as I found in this forum, but it seems that it does not works, alerts always came back :/


Is there anything else to do ?

thx

[cyber]

Look into template macros instead of global regexes. There should be something like $NAME_NOT_MATCHES or similar... I don't remember exactly the name..
Global regexes are there mostly for backward compatibility. They are not used in newer versions of templates any more...

[eglyn]

---

Ok, I tried to find this, but i don't really uderstand what to do:
I have:

{$SERVICE.NAME.NOT_MATCHES} ^(?:RemoteRegistry|MMCSS|gupdate|SysmonLog|clr_opt imization_v.+|clr_optimization_v.+|sppsvc|gpsvc|Pm l Driver HPZ12|Net Driver HPZ12|MapsBroker|IntelAudioService|Intel\(R\) TPM Provisioning Service|dbupdate|DoSvc)$

I tried to add WpnUserService_ at the end of the line (after DoSvc) but nothing change, alert come back :/

[eglyn]

ok, finally, i found:
It is in discovery rules and filters: