All Apps and Add-ons

Whitelisting in InfoSec App

theSOCguy
Explorer

Hello humans (and non-humans), 

I am rocking the base model Enterprise (9.0) with an InfoSec app as my SIEM. Right now I see all of the scanner activity, along with service accounts. Since my scanners are testing for Apache vulns, I am getting alerts for it. Is there a way to prevent the InfoSec app from reporting "asset list" worthy events? My understanding is that Asset Lists are only configurable on ES.

Thank you!

theSOCguy 

Labels (3)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...

Splunk AppDynamics with Cisco Secure Application

Web applications unfortunately present a target rich environment for security vulnerabilities and attacks. ...