SPLUNK aide.conf exclusions

[argo]

We are scanning our splunk enterprise instance with AIDE for linux and have a decent set of exclusions defined otherwise it is VERY noisy with findings. We are still getting quite a bit of noise from things like installed apps or add ons in seemingly benign files. Is there a recommended AIDE configuration for Splunk that will focus it only on the 'important' files. We don't want to too broadly just exclude top level directories so if this has been solved, I would love to hear about your aide.conf exclusion settings for splunk.

[isoutamo]

Hi

you could use Splunk's antivirus configuration as a baseline for aide. See those from https://docs.splunk.com/Documentation/Splunk/9.1.2/ReleaseNotes/RunningSplunkalongsideWindowsantivir...

r. Ismo