https://community.splunk.com/t5/Getting-Data-In/SPLUNK-aide-conf-exclusions/m-p/670403#M112415 <P>We are scanning our splunk enterprise instance with AIDE for linux and have a decent set of exclusions defined otherwise it is VERY noisy with findings. We are still getting quite a bit of noise from things like installed apps or add ons in seemingly benign files. Is there a recommended AIDE configuration for Splunk that will focus it only on the 'important' files. We don't want to too broadly just exclude top level directories so if this has been solved, I would love to hear about your aide.conf exclusion settings for splunk.</P> Thu, 30 Nov 2023 22:25:50 GMT argo 2023-11-30T22:25:50Z https://community.splunk.com/t5/Getting-Data-In/SPLUNK-aide-conf-exclusions/m-p/670403#M112415 <P>We are scanning our splunk enterprise instance with AIDE for linux and have a decent set of exclusions defined otherwise it is VERY noisy with findings. We are still getting quite a bit of noise from things like installed apps or add ons in seemingly benign files. Is there a recommended AIDE configuration for Splunk that will focus it only on the 'important' files. We don't want to too broadly just exclude top level directories so if this has been solved, I would love to hear about your aide.conf exclusion settings for splunk.</P> Thu, 30 Nov 2023 22:25:50 GMT https://community.splunk.com/t5/Getting-Data-In/SPLUNK-aide-conf-exclusions/m-p/670403#M112415 argo 2023-11-30T22:25:50Z https://community.splunk.com/t5/Getting-Data-In/SPLUNK-aide-conf-exclusions/m-p/670428#M112418 <P>Hi</P><P>you could use Splunk's antivirus configuration as a baseline for aide. See those from&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/9.1.2/ReleaseNotes/RunningSplunkalongsideWindowsantivirusproducts" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.1.2/ReleaseNotes/RunningSplunkalongsideWindowsantivirusproducts</A></P><P>r. Ismo</P> Fri, 01 Dec 2023 07:33:07 GMT https://community.splunk.com/t5/Getting-Data-In/SPLUNK-aide-conf-exclusions/m-p/670428#M112418 isoutamo 2023-12-01T07:33:07Z