How to omit Scanners as a "Threat" from the Splunk App for Enterprise Security?

[gwalford]

I am running some Nessus scanners - these systems have not yet been integrated with Splunk.

Splunk's Enterprise Security application is listing these systems as high scanning activity devices under the network dashboards:
http://docs.splunk.com/Documentation/ES/3.3.1/User/NetworkProtectionDomaindashboards#Troubleshooting...

Obviously, I don't want Splunk to alert on high scanning activity from the Nessus systems as we expect them to scan. I am more concerned about systems that are performing scanning activity that are not my Nessus systems showing up in this list.

What is the best way to accomplish this? How would I whitelist the Nessus systems? Is a lookup best, or should I use the CIM and the data models?

I see two potential options for displaying these: 1) display only the unknown scanning systems or 2) colour the Nessus scanning systems as a green bar, and the unknown as red.

What is the best way to go about solving this problem?

[jcoates_splunk · Accepted solution]

http://docs.splunk.com/Documentation/ES/3.3.2/Install/FAQ#Whitelist_vulnerability_scanners_from_cons...

[gwalford]

Well damn that was easy.

I must have used the wrong Google-Fu because I could not find that part of the docs!