Splunk Enterprise Security

Best way to filter out events within Splunk Enterprise Security Incident Review?

AshTillman11
Engager

I am seeing a number of events for abnormally high number of HTTP POST requests in our enterprise security incident review, many of which are allowed communication between our systems. What would be the best method to eliminate these events from view in order to drill down actual potential malicious activity? I created event suppressions, yet a few of them still seem to trigger events in Incident Review.

What would be the best solution to achieve this creating a whitelist, notable event suppression, or creating or editing the current correlation search?

Within notable event suppression is it possible to use wildcards in fields such as http_method, to capture all POST, GET, and HEAD events from a certain srcip to dest_ip or would I need to create a suppression for each type?

Also, if whitelisting would be the better option, is it possible to whitelist based on SRC IP to a specific dest IP over certain ports?

1 Solution

samhodgson
Path Finder

Hi,

I had this question answered in the following thread:

https://answers.splunk.com/answers/587812/whitelisting-values-for-notable-events.html#answer-588763

Thanks to @smoir and @starcher

Cheers

Sam

View solution in original post

samhodgson
Path Finder

Hi,

I had this question answered in the following thread:

https://answers.splunk.com/answers/587812/whitelisting-values-for-notable-events.html#answer-588763

Thanks to @smoir and @starcher

Cheers

Sam

AshTillman11
Engager

Thanks!!!!

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...