Help configuring FileBlockShredding event logging using sysmon

Question

Hi,

I've tried adding FileBlockShredding in event filter but it throws the following error while i update the configuration

Error

• Element RuleGroup content does not follow the DTD, expecting (ProcessCreate | FileCreateTime | NetworkConnect | ProcessTerminate | DriverLoad | ImageLoad | CreateRemoteThread | RawAccessRead | ProcessAccess | FileCreate | RegistryEvent | FileCreateStreamHash | PipeEvent | WmiEvent | DnsQuery | FileDelete | ClipboardChange | ProcessTampering | FileDeleteDetected | FileBlockExecutable), got (FileBlockShredding )

My Configuration

<RuleGroup name="Evt_28_inc" groupRelation="or">
<FileBlockShredding onmatch="exclude"/>
</RuleGroup>

Kindly help me on how to do proper configuration for this

Regards,
Max

@Markus Schlegel @Markus Östlund @Markus Schwarzer

Answer 1

Hi,

Found the answer i made a mistake in schemaversion. FileBlockShredding is supported from version 4.83 only.

Thank you.
Max