I am seeing a number of events for abnormally high number of HTTP POST requests in our enterprise security incident review, many of which are allowed communication between our systems. What would be the best method to eliminate these events from view in order to drill down actual potential malicious activity? I created event suppressions, yet a few of them still seem to trigger events in Incident Review.
What would be the best solution to achieve this creating a whitelist, notable event suppression, or creating or editing the current correlation search?
Within notable event suppression is it possible to use wildcards in fields such as http_method, to capture all POST, GET, and HEAD events from a certain srcip to dest_ip or would I need to create a suppression for each type?
Also, if whitelisting would be the better option, is it possible to whitelist based on SRC IP to a specific dest IP over certain ports?
