All Apps and Add-ons
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question

Whitelisting in InfoSec App

theSOCguy
Explorer
‎06-22-2022 09:29 AM

Hello humans (and non-humans), 

I am rocking the base model Enterprise (9.0) with an InfoSec app as my SIEM. Right now I see all of the scanner activity, along with service accounts. Since my scanners are testing for Apache vulns, I am getting alerts for it. Is there a way to prevent the InfoSec app from reporting "asset list" worthy events? My understanding is that Asset Lists are only configurable on ES.

Thank you!

theSOCguy 

Labels (3)
Labels
Tags (1)
0 Karma
Reply
Get Updates on the Splunk Community!

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...