All Apps and Add-ons
×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

Whitelisting in InfoSec App

theSOCguy
Explorer
‎06-22-2022 09:29 AM

Hello humans (and non-humans), 

I am rocking the base model Enterprise (9.0) with an InfoSec app as my SIEM. Right now I see all of the scanner activity, along with service accounts. Since my scanners are testing for Apache vulns, I am getting alerts for it. Is there a way to prevent the InfoSec app from reporting "asset list" worthy events? My understanding is that Asset Lists are only configurable on ES.

Thank you!

theSOCguy 

Labels (2)
Labels
Tags (1)
0 Karma
Reply
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...