Splunk Enterprise Security

Best way to filter out events within Splunk Enterprise Security Incident Review?

AshTillman11
Engager

I am seeing a number of events for abnormally high number of HTTP POST requests in our enterprise security incident review, many of which are allowed communication between our systems. What would be the best method to eliminate these events from view in order to drill down actual potential malicious activity? I created event suppressions, yet a few of them still seem to trigger events in Incident Review.

What would be the best solution to achieve this creating a whitelist, notable event suppression, or creating or editing the current correlation search?

Within notable event suppression is it possible to use wildcards in fields such as http_method, to capture all POST, GET, and HEAD events from a certain srcip to dest_ip or would I need to create a suppression for each type?

Also, if whitelisting would be the better option, is it possible to whitelist based on SRC IP to a specific dest IP over certain ports?

1 Solution

samhodgson
Path Finder

Hi,

I had this question answered in the following thread:

https://answers.splunk.com/answers/587812/whitelisting-values-for-notable-events.html#answer-588763

Thanks to @smoir and @starcher

Cheers

Sam

View solution in original post

samhodgson
Path Finder

Hi,

I had this question answered in the following thread:

https://answers.splunk.com/answers/587812/whitelisting-values-for-notable-events.html#answer-588763

Thanks to @smoir and @starcher

Cheers

Sam

AshTillman11
Engager

Thanks!!!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...