https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Web-datamodel-whitelisting/m-p/384325#M3969 <P>Do you want to exclude IP's getting into datamodel? I would suggest to have IPs (e.g. src_ip) in the datamodel and have a category, say (web_blacklist_ips) in your asset data for those IPs. You can then create searches to exclude those Ips using the category.</P> Tue, 29 Sep 2020 23:54:30 GMT lakshman239 2020-09-29T23:54:30Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Web-datamodel-whitelisting/m-p/384324#M3968 <P>Hello Splunkers,</P> <P>Trying to fix the Web data models in the CIM and would like to exclude a couple of IP addresses. However, I'm struggling to form a white list for those specific IP addresses. </P> <P>I'm looking for any guidance links and resources towards creating whitelists, all help is appreciated.<BR /> Thanks, and Happy Splunking!</P> Fri, 29 Mar 2019 07:35:24 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Web-datamodel-whitelisting/m-p/384324#M3968 burakatabay 2019-03-29T07:35:24Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Web-datamodel-whitelisting/m-p/384325#M3969 <P>Do you want to exclude IP's getting into datamodel? I would suggest to have IPs (e.g. src_ip) in the datamodel and have a category, say (web_blacklist_ips) in your asset data for those IPs. You can then create searches to exclude those Ips using the category.</P> Tue, 29 Sep 2020 23:54:30 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Web-datamodel-whitelisting/m-p/384325#M3969 lakshman239 2020-09-29T23:54:30Z